cve-2021-29442-Nacos-Derby-rce-exp

Introduction

Nacos Derby command execution vulnerability exploitation script, by default uses User-Agent bypass to exploit the vulnerability

Nacos is an open-source platform for service registration, discovery, and configuration management. In its early versions (≤2.4.0-BETA), Nacos integrates Apache Derby as the embedded database by default. Since the Derby database does not have access control set by default, attackers can access specific interfaces without authorization, execute arbitrary SQL statements, and ultimately achieve remote command execution.

Vulnerability Principle:

1. Unauthenticated Access: Under default configuration, Nacos's Derby database interface has no access control, allowing anyone to access it.

2. SQL Injection: Attackers send malicious SQL queries to Nacos's Derby interface via specific HTTP requests. For example, access the following URL:

   root@kitploit:~

   http://<Nacos服务器地址>:8848/nacos/v1/cs/ops/derby?sql=select * from users
   

   This will return all data in the users table.

3. Remote Command Execution: More critically, attackers can leverage Derby's specific features to execute arbitrary code via SQL statements. For example, using the CALL statement to load a remote malicious JAR package and execute code within it, thereby executing arbitrary commands on the victim server.

Remediation measures:

• Upgrade Nacos: The official team has fixed this vulnerability in the latest version; it is recommended to upgrade Nacos to the latest version.

• Disable Derby Interface: If not using an embedded database, it is recommended to disable the Derby interface to prevent unauthorized access.