CVE-2021-29441

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

87.75% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-290

Published

2021-04-27

Updated

2024-08-03

Proof-of-concept exploits (5)

• Whoopsunix/nacosScan43★ · 2023-08-09
• azhao1981/CVE-2021-294410★ · 2024-12-04
• bysinks/CVE-2021-294412★ · 2022-03-15
• hh-hunter/nacos-cve-2021-294410★ · 2021-10-05
• K3ysTr0K3R/CVE-2021-29441

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29441.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/nacos/CVE-2021-29441

References

• CVE Record
• NVD entry

Related

• CVE-2022-22947
• CVE-2021-22205
• CVE-2021-24499
• CVE-2023-1177
• CVE-2021-29440
• CVE-2021-29442