CVE-2021-44667: Cross-site Scripting in Nacos
Summary
CVE-2021-44667: Cross-site Scripting in Nacos. Affects com.alibaba.nacos:nacos-common across 2 version ranges.
< 1.4.5
>= 2.0.0-ALPHA.1, < 2.1.0-BETA
Fixed in 1.4.5 or 2.1.0-BETA, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nacos is an open-source platform that provides dynamic service discovery, configuration, and service management for building cloud-native applications. The 'com.alibaba.nacos:nacos-common' package is a Maven package that is part of the Nacos ecosystem. It is used for common functionalities across the Nacos platform.
Vulnerability Detail
A Cross-Site Scripting (XSS) vulnerability has been discovered in Nacos version 2.0.3. This vulnerability exists in the 'auth/users' endpoint and can be exploited through the 'pageSize' and 'pageNo' parameters. An attacker can inject malicious scripts into the application, which will be executed in the context of the user's browser. This can lead to various attacks, such as session hijacking, defacement, or stealing sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.4.51.4.5 -
>= 2.0.0-ALPHA.1, < 2.1.0-BETA2.1.0-BETA
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a temporary workaround is to implement input validation and sanitization on the 'pageSize' and 'pageNo' parameters. Ensure that user-supplied input is properly encoded or filtered to prevent the execution of malicious scripts.
Conclusion
The Cross-Site Scripting vulnerability in Nacos version 2.0.3 can lead to various security risks, including session hijacking and data theft. It is crucial to upgrade to version 2.0.4 or later to mitigate this vulnerability. If immediate upgrade is not possible, implement input validation and sanitization on the affected parameters. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.alibaba.nacos:nacos-common →
FAQ
This vulnerability allows an attacker to execute arbitrary scripts in the context of a user's browser. The impact can range from defacement of the application to stealing sensitive information or performing actions on behalf of the user.
No, only Nacos version 2.0.3 is affected. Versions 2.0.4 and later include a fix for this vulnerability.
No, authentication is not required. An attacker can exploit this vulnerability by sending a specially crafted request to the 'auth/users' endpoint.
Yes, this vulnerability can be exploited remotely. An attacker can send a malicious request to the vulnerable endpoint from anywhere on the internet.
There is no evidence of active exploits targeting this vulnerability at the moment. However, it is recommended to apply the fix as soon as possible to prevent any potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.alibaba.nacos:nacos-common.
