PRP: Request alibaba nacos(<=1.4.0) 'NACOS-ISSUE #4593' CVE-2021-29441 User-Agent authentication bypass vulnerability

[threedr3am]

Hi,

I want to contribute to the tsunami scanner with a plugin to detect alibaba nacos(<=1.4.0) 'NACOS-ISSUE #4593' CVE-2021-29441 User-Agent authentication bypass vulnerability.

Vulnerability details:
alibaba/nacos#4593
When the nacos version is less than or equal to 1.4.0, when accessing the http endpoint, adding the User-Agent: Nacos-Server header can bypass the authentication restriction and access any http endpoint.
https://nvd.nist.gov/vuln/detail/CVE-2021-29441
alibaba/nacos#4701
alibaba/nacos#4703
GHSA-36hp-jr8h-556f

Type: CWE - 306 : Missing Authentication for Critical Function

The vulnerability should have a HIGH or CRITICAL severity rating if there is already a CVE ID assigned (CVSS score >= 7.0). yes
The vulnerability should be relatively new and have already been patched. yes
The vulnerability should have a relatively large impact radius. yes
The vulnerability should be remotely exploitable without authentication and user interaction. yes
The detector should provide a reliable false-positive free detection report. yes
The detector should have good unit test coverage. Google's open source projects should be thoroughly tested and there is no exception for the Tsunami project. yes
The detection capability should be easy to verify using both vulnerable and fixed Docker images. yes

[threedr3am]

dockerfile: https://github.com/threedr3am/nacos-docker

[threedr3am]

1. git clone https://github.com/threedr3am/nacos-docker.git
2. build.sh
3. run.sh