CVE-2021-29441

Name of the Vulnerable Software and Affected Versions Nacos versions prior to 1.4.1

Description Nacos is a platform for dynamic service discovery, configuration, and service management. When configured to use authentication via -Dnacos.core.auth.enabled=true, the system employs the AuthFilter servlet filter to enforce security. This filter contains a backdoor that allows authentication checks to be bypassed by spoofing the user-agent HTTP header. An attacker can exploit this by using the Nacos-Server value in the user-agent header to gain unauthorized access and perform administrative tasks. Additionally, the /derby endpoint within the ConfigOpsController is not protected by the @Secured annotation, allowing unauthenticated users to execute SQL queries against the embedded Derby database via the sql parameter. This specific issue affects only installations using embedded storage.

Recommendations Update Nacos to version 1.4.1 or later. As a temporary mitigation, restrict access to the /derby endpoint to prevent unauthorized database queries.