Nacos 2.0.3 Access Control

Exploit Title: Nacos 2.0.3 - Access Control vulnerability Date: 2023-01-17 Exploit Author: Jenson Zhao Vendor Homepage: https://nacos.io/ Software Link: https://github.com/alibaba/nacos/releases/ Version: Up to including2.0.3 Tested on: Windows 10 CVE : CVE-2021-43116 Required before execution: p...

Nacos 2.0.3 - Access Control vulnerability

Exploit Title: Nacos 2.0.3 - Access Control vulnerability Date: 2023-01-17 Exploit Author: Jenson Zhao Vendor Homepage: https://nacos.io/ Software Link: https://github.com/alibaba/nacos/releases/ Version: Up to including2.0.3 Tested on: Windows 10 CVE : CVE-2021-43116 Required before execution: p...

cc.cc4414:cc-spring-cloud-starter (>=0.3.0 <=0.8.0), cc.cc4414:cc-spring-cloud-starter-gateway (>=0.5.0 <=0.8.0) +1145 more potentially affected by CVE-2021-43116 via com.alibaba.nacos:nacos-client (>=0.1.0 <=2.0.3)

com.alibaba.nacos:nacos-client MAVEN version =0.1.0, =0.3.0, =0.5.0, =1.0.2, =1.0.0, =1.2.1, =1.0.4.R, =2.4.0, =1.1, =1.1, =1.0.0.RELEASE, =0.0.2, =0.0.2, =0.0.4.BETA, =1.0.0, =2.1.0 and more Source cves: CVE-2021-43116 Source advisory: OSV:GHSA-2G86-R6W2-WQQR...

CVE-2021-43116

An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login...

CVE-2021-43116

An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login...

CVE-2021-43116

CVE-2021-43116 affects Nacos 2.0.3 via an Access Control vulnerability in the login flow. According to the connected exploit material, an attacker can login by capturing authentication traffic and modifying the returned package after submitting credentials on the access prompt page, effectively b...