nacos-cve-2021-29441

This repository does not have a README...

CVE-2021-29441

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication -Dnacos.core.auth.enabled=true Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor...

Nacos < 1.4.1 Authentication Bypass (CVE-2021-29441)

Binary data nacoscve-2021-29441.nbin...

CVE-2021-29441

creationtimestamp| type| source ---|---|--- 2021-08-25 13:22:18+00:00| seen| https://t.me/truesecator/2035 2021-10-28 16:23:30+00:00| published-proof-of-concept| https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/nacoscve202129441 2023-12-08 13:07:04+00:00|...

CVE-2021-29441

CVE-2021-29441 affects Nacos before version 1.4.1. The AuthFilter used for enforcing authentication contains a backdoor that lets servers bypass the filter and skip authentication checks; the bypass relies on spoofable User-Agent headers, enabling a user to perform administrative tasks on the Nac...

CVE-2021-29441 Authentication bypass

Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication -Dnacos.core.auth.enabled=true Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor...

com.alibaba.csp:sentinel-datasource-nacos (1.3.0-ga), com.alibaba.nacos:nacos-client (0.3.0) +9 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.3.0)

com.alibaba.nacos:nacos-common MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.3.0-ga - com.alibaba.nacos:nacos-client 0.3.0 -...

cc.cc4414:cc-spring-cloud-starter (>=0.3.0, <=0.8.0), cc.cc4414:cc-spring-cloud-starter-gateway (>=0.5.0, <=0.8.0) +387 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (>=1.0.0-rc1, <=1.4.0)

com.alibaba.nacos:nacos-common MAVEN version =1.0.0-rc1, =0.3.0, =0.5.0, =1.0.0, =1.1, =1.1, =0.0.2.alpha, =0.0.2.alpha, =1.0.8, =1.4.0, =0.1.3, =0.1.21 - cn.lampup.decoration.example-springmvc:decoration-example-springmvc3 0.1.1 and more Source cves: CVE-2021-29441, CVE-2021-29442 Source advisor...

cn.iisme.cloud:iisme-demos-nacos-core (1.0.1), cn.iisme.cloud:iisme-demos-nacos-web (1.0.1) +34 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.8.0)

com.alibaba.nacos:nacos-common MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - cn.iisme.cloud:iisme-demos-nacos-core 1.0.1 - cn.iisme.cloud:iisme-demos-nacos-web 1.0.1 -...

com.alibaba.nacos:nacos-client (0.8.2), com.github.hengboy:micro-job-autoconfigure (0.0.3.release) +10 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.8.2)

com.alibaba.nacos:nacos-common MAVEN version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.nacos:nacos-client 0.8.2 - com.github.hengboy:micro-job-autoconfigure 0.0.3.release -...

com.alibaba.nacos:nacos-client (0.9.0), org.nutz:nutzboot-starter-nacos-config-client (>=2.3.1.v20190318, <=2.3.7.v20190731) potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.9.0)

com.alibaba.nacos:nacos-common MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.nacos:nacos-client 0.9.0 - org.nutz:nutzboot-starter-nacos-config-client...

com.alibaba.csp:sentinel-datasource-nacos (1.3.1), com.alibaba.csp:sentinel-demo-nacos-datasource (1.3.1) +4 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.4.0)

com.alibaba.nacos:nacos-common MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.3.1 - com.alibaba.csp:sentinel-demo-nacos-datasource...

cc.cc4414:cc-spring-cloud-starter (>=0.3.0, <=0.8.0), cc.cc4414:cc-spring-cloud-starter-gateway (>=0.5.0, <=0.8.0) +387 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (>=1.0.0-rc1, <=1.4.0)

com.alibaba.nacos:nacos-common MAVEN version =1.0.0-rc1, =0.3.0, =0.5.0, =1.0.0, =1.1, =1.1, =0.0.2.alpha, =0.0.2.alpha, =1.0.8, =1.4.0, =0.1.3, =0.1.21 - cn.lampup.decoration.example-springmvc:decoration-example-springmvc3 0.1.1 and more Source cves: CVE-2021-29441, CVE-2021-29442 Source advisor...

com.alibaba.csp:sentinel-datasource-nacos (0.2.0), com.alibaba.csp:sentinel-demo-nacos-datasource (0.2.0) +4 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.2.0)

com.alibaba.nacos:nacos-common MAVEN version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 0.2.0 - com.alibaba.csp:sentinel-demo-nacos-datasource...

com.alibaba.nacos:nacos-client (0.3.0-rc1) potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.3.0-rc1)

com.alibaba.nacos:nacos-common MAVEN version 0.3.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.nacos:nacos-client 0.3.0-rc1 Source cves: CVE-2021-29441, CVE-2021-29442 Source...

com.alibaba.nacos:nacos-client (0.8.1) potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.8.1)

com.alibaba.nacos:nacos-common MAVEN version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.nacos:nacos-client 0.8.1 Source cves: CVE-2021-29441, CVE-2021-29442 Source advisory:...

com.alibaba.nacos:nacos-client (0.9.0), org.nutz:nutzboot-starter-nacos-config-client (>=2.3.1.v20190318, <=2.3.7.v20190731) potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.9.0)

com.alibaba.nacos:nacos-common MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.nacos:nacos-client 0.9.0 - org.nutz:nutzboot-starter-nacos-config-client...

cn.iisme.cloud:iisme-demos-nacos-core (1.0.1), cn.iisme.cloud:iisme-demos-nacos-web (1.0.1) +34 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.8.0)

com.alibaba.nacos:nacos-common MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - cn.iisme.cloud:iisme-demos-nacos-core 1.0.1 - cn.iisme.cloud:iisme-demos-nacos-web 1.0.1 -...

com.alibaba.boot:nacos-config-spring-boot-starter (>=0.1.0-rc1, <=0.2.1), com.alibaba.boot:nacos-discovery-spring-boot-starter (>=0.1.0-rc1, <=0.2.1) +4 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.2.1-rc1)

com.alibaba.nacos:nacos-common MAVEN version 0.2.1-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.boot:nacos-config-spring-boot-starter =0.1.0-rc1, =0.1.0-rc1, =0.1.0-rc1, =0.1.0-rc...