add alibaba nacos v1.x authentication bypass detection

[kmahyyg]

本 poc 是检测什么漏洞的

check alibaba/nacos#4593

In brief, while the web console of NacOs is enabled, the authentication can be bypassed by setting http header User-Agent: Nacos-Server even the authentication is enabled.

测试环境

Use the official docker image.

1. Clone https://github.com/nacos-group/nacos-docker
2. Append this to <REPO ROOT>/env/nacos-hostname.env

NACOS_AUTH_ENABLE=true
NACOS_AUTH_TOKEN=this-is-a-very-long-token-at-least-192-bytes-recommend-256-bytes-without-any-special-symbols

3. sudo docker-compose -f ./example/cluster-hostname.yaml up

备注

Nothing else.

Already lint, and tested.

[zema1]

感谢大佬，poc 写的很棒。如果是第一次提交，可以联系小 Ray（微信号 xraysec ) 拉到核心贡献者群，也可以查看该链接按需获取奖励。https://docs.xray.cool/#/guide/contribute?id=%e5%a5%96%e5%8a%b1%e6%8e%aa%e6%96%bd