CVE-2021-29442highobserved exploitationCWE-306

CVE-2021-29442: high-severity vulnerability in alibaba nacos

Authentication bypass

Published · Updated

Follow this CVE+ Monitor nacos+ Monitor com.alibaba.nacos:nacos-common

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

90Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.6epss 64%
from disclosure to weapon1305 days
Published on NVDApr 27
1st PoC+1305d
VulnCheck+936d
In short

Nacos before version 1.4.1 allows unauthenticated users to access the /derby endpoint and perform dangerous database operations like querying or wiping out the embedded database. This bypasses authentication controls that protect similar endpoints.

Technical detail

Authentication bypass in Nacos ConfigOpsController where the /derby endpoint lacks @Secured annotation, allowing unauthenticated access to database management operations on embedded Derby storage. The /data/remove endpoint implements proper authentication while /derby does not, creating an inconsistent security posture. Impact is limited to deployments using embedded storage rather than external databases.

Summary generated and translated by AI from the official description.
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
alibaba · nacos
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — alibaba nacos

In the same product, most dangerous first.

CVE-2021-29441HIGHAuthentication bypassEPSS 83.2%