CVE-2021-29442 — AI Deep Analysis Summary

🚨 **Essence**: Alibaba Nacos has an **Access Control Error** (CWE-306). The `ConfigOpsController` allows unauthenticated users to perform dangerous admin operations.…

🛡️ **Root Cause**: Missing Access Control on specific endpoints. While `/data/remove` is secured, the `/derby` endpoint is **not protected** by `@Secured` annotation.…

📦 **Affected**: Alibaba Nacos versions **before 1.4.1**. 🖥️ **Component**: Specifically impacts installations using **embedded Derby database**.…

🕵️ **Privileges**: Unauthenticated users gain **Admin-level access**. 💾 **Data Impact**: Can execute arbitrary SQL queries. 🗑️ **Worst Case**: Can **delete/clear the entire database**.…

🔓 **Threshold**: **LOW**. No authentication required. 🌐 **Config**: Only requires the service to be running with the default embedded Derby storage. No special configuration needed for exploitation.…

🔥 **Public Exp**: **YES**. Multiple PoCs exist on GitHub (e.g., `QVD-2024-26473`, `vulhub`). 🌍 **Wild Exploitation**: High risk. Search engines like FOFA and ZoomEye can easily locate vulnerable targets.…

🔍 **Self-Check**: Scan for Nacos instances using FOFA (`app="Nacos"`). 🧪 **Test**: Send a GET request to `/nacos/v1/cs/ops/derby?sql=select * from users`.…

🔧 **Official Fix**: **YES**. Patched in Nacos version **1.4.1** and later. 📢 **Action**: Upgrade immediately. 📝 **PR**: See GitHub PR #4517 for details.…

🚧 **Workaround**: If upgrading is impossible, **disable the Derby endpoint**. 🔒 **Network**: Block external access to port 8848.…

🚨 **Urgency**: **CRITICAL**. Priority: **P1**. ⏳ **Time**: Patch immediately. 📉 **Risk**: High CVSS score (AV:N/AC:L/PR:N/S:C/C:H/I:N/A:N). 💣 **Impact**: Complete data loss or RCE. Do not delay remediation.