Authentication Bypass in Nacos AuthFilter (User-Agent Backdoor)

This repository is a small standalone Python proof-of-concept/operational exploit for CVE-2021-29441, an authentication bypass in Alibaba Nacos before 1.4.1. The repo contains only two files: a README describing the vulnerability and exploit conditions, and a single executable script, exploit.py, which is the main entry point. The exploit works by creating a requests.Session and hardcoding the spoofed header 'User-Agent: Nacos-Server', which the vulnerable Nacos AuthFilter incorrectly trusts as an internal request marker. Using that bypass, the script interacts directly with Nacos administrative user-management APIs under /nacos/v1/auth/users. Capabilities implemented in code are broader than simple detection: it can check vulnerability by attempting to list users, enumerate existing users, create a new user with attacker-chosen credentials, delete an existing user, and update/reset a user's password. This makes it an operational exploit rather than a detection-only script. Repository structure is minimal and straightforward. README.md provides context, impact, affected versions, and remediation. exploit.py contains a NacosExploit class with helper request logic, individual methods for each administrative action, CLI argument parsing, and a main() routine. The script supports target selection, optional SSL verification disabling, and action flags (--check, --list, --create, --delete, --update-password). It prints status codes and optionally formats output with the rich library if installed. No reverse shell or post-exploitation implant is included; the payload is the crafted HTTP interaction itself. The primary security impact is unauthorized administrative access to Nacos user management over the network.