Security risk of the default Nacos token.secret.key-Microservices Engine(MSE)-阿里云帮助中心

Using the default token.secret.key in Nacos creates an Authentication Bypass vulnerability. This topic explains how to mitigate this Security Risk.

Risk description

The Nacos community issued a security advisory in Version 2.2.0.1. For more information, see Security Advisory on the Nacos Default token.secret.key and Solutions.

Attackers can exploit the default token.secret.key to bypass Authentication.

The following clusters are affected by this security risk. Review your configuration and follow the guidance in this topic to ensure proper usage.

Self-managed Nacos clusters running versions 1.2.0 through 2.2.0 that do not have a custom key configured. For instructions, see Nacos.
Self-managed Nacos clusters running Version 2.2.0.1 or later that are still configured with the default value.

Microservices Engine (MSE) is not affected by this Security Risk.

Important

MSE Nacos Basic Edition Version 1.1.3 (maintenance ended): This version does not support authentication and does not support the Configuration Center. Therefore, it is not vulnerable.
MSE Nacos Basic Edition Version 1.2.1 (feature updates ended): Authentication is disabled by default when you create a cluster. When authentication is enabled, the system uses Alibaba Cloud Resource Access Management (RAM) for authentication, not the token.secret.key parameter. Therefore, this version is not vulnerable.
MSE Nacos Professional Edition: Authentication is disabled by default when you create a cluster. When authentication is enabled, the system uses RAM for authentication, not the token.secret.key parameter. Therefore, this version is not vulnerable.

Verify that a public whitelist is configured for your MSE Nacos engine instance. If not, configure one to block requests from unexpected sources. For more information, see Configure a whitelist.
If your MSE Nacos engine instance is running Basic Edition Version 1.1.3, upgrade it to Version 1.2.1 or later. For instructions, see Upgrade Nacos from Version 1.1.3 to 1.2.1.
Note
MSE Nacos Basic Edition instances support authentication for the Configuration Center only. For comprehensive protection, upgrade your instance to the latest Professional Edition and enable authentication for the Service Registry. For instructions, see Upgrade Nacos Basic Edition to the Professional or Developer Edition.
Enable authentication for your MSE Nacos engine instance. For instructions, see Enable authentication.