Nacos Hessian反序列化漏洞

Nacos在处理某些基于Jraft的请求时，采用Hessian进行反序列化，但并未设置限制，导致应用存在远程代码执行（RCE）漏洞。

#FOFA搜索语法protocol="nacos(http)"

GET /nacos/v1/console/server/state HTTP/1.1Host: ipCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9If-Modified-Since: Wed, 28 Jul 2021 11:28:45 GMTConnection: close

GET / HTTP/1.1Host: ipCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.111 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: zh-CN,zh;q=0.9If-Modified-Since: Wed, 28 Jul 2021 11:28:45 GMTConnection: close

id: nacos-jraft-hessian-rceinfo:  name: nacos-jraft-hessian-rce  author: sm  severity: critical  tags: nacos,rce,Hessian,nacos-rce  description: Nacos在处理某些基于Jraft的请求时，采用Hessian进行反序列化，但并未设置限制，导致应用存在远程代码执行（RCE）漏洞  metadata:     fofa-query: "protocol="nacos(http)""    verified: true  reference: https://mp.weixin.qq.com/s/FUBdfMugEd-5k-CGyLbuJwtcp:  - inputs:    host:      - "{{Host}}:7848"    matchers:      - type: word        words:          - ""

id: nacos-jraftserver-deserialization-rceinfo:  name: Nacos - jraftserver deserialization Remote Code Execution  author: unknown  severity: critical  description: Nacos uses Hessian for deserialization when processing certain Jraft based requests, but no restrictions are set, resulting in remote code execution (RCE) vulnerabilities in the application.   reference: https://stack.chaitin.com/techblog/detail?id=106  tags: nacos,rce,nacos-rce  metadata:    max-request: 1http:  - method: GET    path:      - "{{BaseURL}}/nacos/v1/console/server/state"      - "{{BaseURL}}/v1/console/server/state"    matchers-condition: or    matchers:      - type: word        words:          - '"standalone_mode":"cluster"'        part: body      - type: regex        regex:          - '"version":"2..*?"'        part: body

https://github.com/charonlight/NacosExploitGUI