admin/0day
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add Nacos 未授权访问漏洞

Browse Source
This commit is contained in:
helloexp 2023-03-29 17:12:35 +08:00
parent a2e4fc15f2
commit f12878fe43
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
96-Java专区/1-Nacos/多个版本未授权访问.sh Normal file
View File

@ -0,0 +1,10 @@
nacos 下面的文件中，嵌入了默认的secret.key
通过此key ，可以构造有效的jwt 文件，然后直接可以获取服务器的敏感信息
distribution/conf/application.properties
nacos.core.auth.plugin.nacos.token.secret.key=SecretKey012345678901234567890123456789012345678901234567890123456789
漏洞影响版本
0.1.0 <= Nacos <= 2.2.0.1