Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nacos is a platform designed for dynamic service discovery and configuration and service management. In
    Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos
    uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables
    Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the
    user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any
    administrative tasks on the Nacos server. (CVE-2021-29441)

A change introduced in Nacos prior to 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.

ID	Name	Product	Family	Severity
409340	SCA: security update for com.alibaba.nacos:nacos-common (GHSA-36hp-jr8h-556f)	Tenable Cloud Security	SCA Checks	critical
409340	SCA: security update for com.alibaba.nacos:nacos-common (GHSA-36hp-jr8h-556f)	Tenable Self-Hosted Container Security	SCA Checks	critical
154416	Nacos < 1.4.1 Authentication Bypass (CVE-2021-29441)	Nessus	Web Servers	critical

Detections

Analytics

CVE-2021-29441

critical

Tenable Plugins

critical

critical

critical