Authentication bypass
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.6epss 65%
from disclosure to weapon1305 days
Published on NVDApr 27
1st PoC+1305d
VulnCheck+936d
exploitation probability
65%top 1% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
In short
Nacos before version 1.4.1 allows unauthenticated users to access the /derby endpoint and perform dangerous database operations like querying or wiping out the embedded database. This bypasses authentication controls that protect similar endpoints.
Technical detail
Authentication bypass in Nacos ConfigOpsController where the /derby endpoint lacks @Secured annotation, allowing unauthenticated access to database management operations on embedded Derby storage. The /data/remove endpoint implements proper authentication while /derby does not, creating an inconsistent security posture. Impact is limited to deployments using embedded storage rather than external databases.
Summary generated and translated by AI from the official description.
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
alibaba · nacospublic PoCs found — 2
vulncheckvulncheck.com/xdb/fcdd46d9ff5bunverifiedvulncheckvulncheck.com/xdb/33071aac3301unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.