CVE-2021-29441 - Nacos Authentication Bypass

CVE-2021-29441 is a critical authentication bypass vulnerability affecting Nacos versions prior to 1.4.1. Nacos is a popular platform for dynamic service discovery, configuration management, and service administration used within cloud-native environments. The vulnerability allows unauthenticated attackers to bypass authentication controls and perform administrative actions on vulnerable Nacos servers.

Vulnerability Details

The vulnerability exists within Nacos' AuthFilter component. When authentication is enabled, the filter relies on a trusted User-Agent header value to identify internal server requests. An attacker can simply spoof this header to bypass authentication checks entirely.

Impact

Successful exploitation may allow an attacker to:

• Bypass authentication mechanisms
• Access protected administrative endpoints
• Modify configuration data
• Manage services and namespaces
• Perform administrative operations without valid credentials

In affected environments, attackers can effectively gain administrative access to the Nacos management interface.

Technical Root Cause

The flaw originates from an insecure trust model within the authentication filter. Instead of cryptographically validating internal requests, Nacos trusted requests containing a specific User-Agent value.

Because HTTP headers are fully controllable by clients, attackers can forge the expected header and bypass authentication controls. This represents a classic example of authentication bypass through spoofing (CWE-290).

Exploitation Conditions

An attacker must:

1. Have network access to the Nacos instance.
2. Target a vulnerable version prior to 1.4.1.
3. Send crafted requests containing the expected spoofed User-Agent header.

No valid credentials or prior access are required.

Remediation

Upgrade

Update Nacos to version 1.4.1 or later, which removes the vulnerable authentication bypass mechanism.

References

• NVD Advisory
• GitHub Security Advisory
• Alibaba Nacos Security Fix
• Nacos Issue Tracker

---

Disclaimer

This repository is intended for educational purposes, security research, and authorized penetration testing only. Any proof-of-concept (PoC) code or exploit material provided here is designed to help security professionals understand the vulnerability, validate patches.