Important Nacos vulnerabilities-Alibaba Cloud Security Guide-阿里云帮助中心

Remediation guide for important Nacos vulnerabilities

Threat Description

Nacos provides features for dynamic service discovery, service configuration, service metadata, and traffic management. Improper configurations or authorization can allow attackers to gain unauthorized access to Nacos or use malicious requests, which can lead to sensitive information leakage.

Vulnerability details: https://avd.aliyun.com/detail/AVD-2024-1738079?spm=5176.2020520154.sas.12.226eTkMRTkMRJu&lang=zh

Remediation suggestions

1. For information about how to troubleshoot and fix common security issues, see the official Nacos document, Nacos Secure Usage Best Practices - Access Control Practices.

Security issue	Remediation suggestion
JSON Web Token (JWT) signature forgery with the default key	1. Check whether the `token.secret.key` is set to the default value: `SecretKey01234567890123456789012345678901234567890123456789012345678`. If it is, update it to a custom Base64 string immediately. Ensure that this configuration value or environment variable is consistent across all Nacos nodes. For Nacos deployments that do not use images, modify the `nacos.core.auth.plugin.nacos.token.secret.key` or `nacos.core.auth.default.token.secret.key` configuration item in the configuration file. For Nacos deployments that use images, modify the `NACOS_AUTH_TOKEN` environment variable.
Unauthorized API access or permission bypass	1. Follow the remediation suggestion for "JSON Web Token (JWT) signature forgery with the default key" to check and update the `token.secret.key`. 2. Check whether `server.identity` is set to the default values `serverIdentity` and `security`. If it is, update it to a custom Base64 string immediately. Ensure that this configuration value or environment variable is consistent across all Nacos nodes. For Nacos deployments that do not use an image, modify the nacos.core.auth.server.identity.key and nacos.core.auth.server.identity.value configuration items in the configuration file. For Nacos deployments that use images, modify the `NACOS_AUTH_IDENTITY_KEY` and `NACOS_AUTH_IDENTITY_VALUE` environment variables. 3. After you confirm that `token.secret.key` and `server.identity` are not set to their default values, check whether authentication is disabled. If authentication is disabled, enable it immediately. For deployments that do not use images: Set the `nacos.core.auth.enabled` configuration item to `true` in the configuration file. For Docker image deployments: Add the `NACOS_AUTH_ENABLE` environment variable to the container and set its value to `true`.
SQL injection or actuator endpoint information leakage	Upgrade to the latest version to prevent this type of threat.

2. Handle potentially leaked keys. If you stored keys, such as an Alibaba Cloud AccessKey, in plaintext in the Nacos service, rotate and disable the related AccessKey immediately. For more information, see Solutions for leaked AccessKeys.

If you encounter any difficulties during the remediation process or have other questions, go to Security Center, click Need Security Help, and contact a technical engineer for support.