CVE-2021-29441
HIGH EXPLOITED IN THE WILD NUCLEINacos < 1.4.1 - Authentication Bypass via User-Agent Spoofing
Title source: llmExploitation Summary
CVE-2021-29441 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 4 public exploits from researchers including azhao1981, hh-hunter. A Nuclei detection template is also available.
AI-analyzed exploit summary This Go script exploits CVE-2021-29441, an authentication bypass vulnerability in Alibaba Nacos, allowing unauthorized user creation. It checks for vulnerability presence and optionally creates a new user with specified credentials.
Description
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.
Exploits (4)
This Go script exploits CVE-2021-29441, an authentication bypass vulnerability in Alibaba Nacos, allowing unauthorized user creation. It checks for vulnerability presence and optionally creates a new user with specified credentials.
The repository contains Docker Compose configurations for setting up Nacos with MySQL in both vulnerable and patched states but lacks actual exploit code or technical details about CVE-2021-29441.
This Go-based exploit demonstrates CVE-2021-29441, an authentication bypass vulnerability in Alibaba Nacos that allows unauthorized user creation. The PoC sends crafted HTTP requests to add a new user without authentication.
This Go-based exploit demonstrates CVE-2021-29441, an authentication bypass vulnerability in Alibaba Nacos. It creates a new user account without proper authorization by sending crafted HTTP requests to the '/nacos/v1/auth/users' endpoint.
Nuclei Templates (1)
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N