CVE-2021-29442 PoC — Authentication bypass

Source

https://github.com/VictorShem/QVD-2024-26473

Associated Vulnerability

Title: Authentication bypass (CVE-2021-29442)
Description:Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)

Description

QVD-2024-26473 && CVE-2021-29442

Readme

# QVD-2024-26473
QVD-2024-26473 &amp;&amp; CVE-2021-29442


# FOFA Search:
https://fofa.info/result?qbase64=YXBwPSJOYWNvcyI%3D
# ZoomEye Search:
https://www.zoomeye.org/searchResult?q=app%3A%22Alibaba%20Nacos%22

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →