Alibaba Nacos AuthFilter Authentication Bypass

This 34-file repository is a deliberately vulnerable Nacos training environment with a standalone Python exploit, not an exploit-framework module. app/ contains the vendored Vulhub walkthroughs, upstream Compose configuration, requests dependency pin, and app/poc.py. The script accepts one target base URL, sends User-Agent: Nacos-Server to the user listing API, and conditionally submits an account-creation request for vulhub/vulhub. It checks response status and text but does not print the enumerated user data. It has no request timeouts or exception handling and exits with status 1 even after successful account creation. Detection alone does not distinguish a genuine bypass from an API already exposed because authentication is disabled. The documentation identifies versions before 1.4.1 as affected; the supplied target is specifically Nacos 1.4.0. build/nacos/Dockerfile enables authentication in vulhub/nacos:1.4.0 and clears JAVA_OPT to remove the upstream JDWP debugger. base/ preserves the upstream image Dockerfile. The separate vendored app/docker-compose.yml still exposes debugger port 5005 and uses the unmodified image, so it differs materially from the main lab configuration. Account creation is implemented, but administrator role assignment, full-console authorization, command execution, and flag retrieval are not demonstrated by the code. Although CTF metadata asks for a flag, no flag placement or retrieval implementation is present in the supplied files. isoloom.yml defines a single amd64 Nacos service on port 8848 within an offline lab network. .isoloom/ contains generated Docker Compose, Kubernetes manifests and check jobs, a multi-provider Vagrantfile, Proxmox Terraform, and six cloud Terraform variants for AWS, Azure, DigitalOcean, GCP, Linode, and OCI. Docker attempts to block internet access by removing the default route; Kubernetes expresses isolation through NetworkPolicies. checks/auth.sh verifies the server version and rejection of ordinary anonymous user listing, while generated checks test availability and isolation rather than the bypass itself. Cloud deployments restrict SSH and published Nacos access to an operator-supplied CIDR. GitHub workflows validate and run the lab and publish it through secret-configured services; their backend and token endpoint values are not supplied. Cleanup commands in provisioning and CI are contextual maintenance operations, not evidence of a fake exploit. The code-file count of 16 includes one Python file, five shell scripts, one Ruby Vagrantfile, seven Terraform files, and two Dockerfiles; YAML deployment/workflow files are recorded separately as declarative configuration. The original repository URL, analyzed git reference, and archive size were not provided, so their fields use empty-string/zero placeholders. UPSTREAM.md identifies the vendored Vulhub source commit as 8fd63916f7a8711e2e01dda0d27237e4d6175d38, not necessarily the commit of this repository. Analysis is static; no exploit or deployment was executed.

This repository is a small standalone Python proof-of-concept/operational exploit for CVE-2021-29441, an authentication bypass in Alibaba Nacos before 1.4.1. The repo contains only two files: a README describing the vulnerability and exploit conditions, and a single executable script, exploit.py, which is the main entry point. The exploit works by creating a requests.Session and hardcoding the spoofed header 'User-Agent: Nacos-Server', which the vulnerable Nacos AuthFilter incorrectly trusts as an internal request marker. Using that bypass, the script interacts directly with Nacos administrative user-management APIs under /nacos/v1/auth/users. Capabilities implemented in code are broader than simple detection: it can check vulnerability by attempting to list users, enumerate existing users, create a new user with attacker-chosen credentials, delete an existing user, and update/reset a user's password. This makes it an operational exploit rather than a detection-only script. Repository structure is minimal and straightforward. README.md provides context, impact, affected versions, and remediation. exploit.py contains a NacosExploit class with helper request logic, individual methods for each administrative action, CLI argument parsing, and a main() routine. The script supports target selection, optional SSL verification disabling, and action flags (--check, --list, --create, --delete, --update-password). It prints status codes and optionally formats output with the rich library if installed. No reverse shell or post-exploitation implant is included; the payload is the crafted HTTP interaction itself. The primary security impact is unauthorized administrative access to Nacos user management over the network.