CVE-2021-29442: Authentication bypass
Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2021-29442.
What is the severity of CVE-2021-29442?
The severity of CVE-2021-29442 is high with a CVSS score of 7.5.
What is Nacos?
Nacos is a platform designed for dynamic service discovery, configuration, and service management.
What version of Nacos is affected by CVE-2021-29442?
Nacos version up to and excluding 1.4.1 is affected by CVE-2021-29442.
How can the ConfigOpsController vulnerability be exploited?
The user can perform management operations like querying the database or wiping it out using the ConfigOpsController in Nacos before version 1.4.1.