References https://github.com/adysec/POC/blob/main/wpoc/Nacos/Nacos%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md https://comate.baidu.com/zh/page/085r4vemaj7 https://zhuanlan.zhihu.com/p/719081738 https://cloud.tencent.com/developer/article/2470017 https://blog.csdn.net/zzxx191z/article/details/140687614 https://rivers.chaitin.cn/blog/cqmr3op0lnec5jjug88g https://wlaq.dlut.edu.cn/info/1095/5094.htm https://uzzju.com/post/87.java https://www.cnblogs.com/spmonkey/p/18304811 https://github.com/Wileysec/nacos_derby_rce https://www.secrss.com/articles/68276 https://bbs.chaitin.cn/topic/2531 https://developer.aliyun.com/ask/682247 https://github.com/XiaomingX/cve-2021-29442-Nacos-Derby-rce-exp https://medium.com/@tvvzvpb186/nacos-admin-interface-rce-sqli-to-full-system-compromise-7510a52c14f0
Related VulnerabilitiesPoCnacos-v3-auth-scope-bypass: Nacos 3.x - Unauthenticated Admin TakeoverNacos /nacos/actuator 未授权访问漏洞PoC(CVE-2025-15004)DedeCMS至5.7.118版本freelist_main.php文件orderby参数SQL注入漏洞Nacos /nacos/v1/cs/configs 信息泄露漏洞Nacos /nacos/v1/auth/users/login 默认口令漏洞nacos-unauthorized-config-download: Nacos 未授权下载配置信息nacos-sync-login-bypass: Nacos-Sync 未授权进后台Nacos /nacos/v1/auth/users 权限绕过漏洞(CVE-2021-43116)PoCCVE-2021-29441: Nacos <1.4.1 - Authentication BypassPoCCVE-2021-29442: Nacos <1.4.1 - Authentication Bypass