Detection system and method for Nacos unauthorized access vulnerabilities

Abstract

The invention provides a detection system and method for Nacos unauthorized access vulnerabilities, and the method comprises the steps: inputting a target IP address list to a scanning module, and detecting the network accessibility of each IP address in the IP address list; detecting all ports of the reachable IP address of the network, identifying services running under the open ports, and carrying out service classification; initiating a Get request under a user information path of the Nacos service; if the request is successful, intercepting a data packet of the request and carrying out transformation and data replay on the data packet; a login request is sent to a login page of the Nacos, and a user name and password parameters are customized for login; if the login succeeds, crawling a YML format file in a configuration list of the Nacos configuration management page to a local computer by using a crawler script; analyzing the YML format file of the Nacos of the local computer, and extracting sensitive information in the file; and generating a Nacos YML file sensitive information detection report according to the extracted sensitive information.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability detection, and in particular to a system, method, electronic device and storage medium for detecting unauthorized access vulnerabilities in Nacos. Background Art

[0002] Nacos is an open source dynamic service discovery, configuration management and service management platform, mainly used for service governance in microservice architecture. When the Nacos service is improperly configured, the user is not authenticated or there are loopholes in the authentication process, which allows unauthorized users to access or operate the Nacos service, thereby obtaining sensitive information or performing unauthorized operations.

[0003] The vulnerability detection does not have the function of automatically registering the Nacos service account, making it difficult to deeply explore the vulnerabilities in the YML files in the configuration list of the Nacos configuration management page. Usually, it is necessary to manually complete the account registration of the unauthorized access vulnerability, log in to Nacos, and then analyze the YML files one by one.

[0004] To solve the above problems, a system, method, electronic device and storage medium for detecting unauthorized access vulnerabilities in Nacos are proposed herein. Summary of the invention

[0005] The embodiments of the present disclosure aim to solve at least one of the technical problems existing in the prior art, and provide a system, method, electronic device and storage medium for detecting unauthorized access vulnerabilities in Nacos.

[0006] In a first aspect of the present disclosure, a system for detecting unauthorized access vulnerabilities in Nacos is provided, comprising:

[0007] A scanning module is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service;

[0008] The request module is used to transform the Get request of the data packet into a Post request and complete the request replay of the data packet;

[0009] The parsing module is used to parse the YML file in the configuration list of the Nacos configuration management page and detect sensitive information in the YML file;

[0010] The detection report module is used to generate a Nacos YML file sensitive information detection report based on the sensitive information extracted from the YML file.

[0011] A second aspect of the present disclosure provides a method for detecting unauthorized access vulnerabilities in Nacos, including:

[0012] Inputting a target IP address list into the scanning module, and detecting the network reachability of each IP address in the IP address list;

[0013] If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers;

[0014] Classify services by identifying services running under open ports;

[0015] If the service is classified as Nacos's Web service, initiate a Get request to the user information path of the Nacos service at / nacos / v1 / auth / users?pageNo=1&pageSize=9;

[0016] If the request is successful, intercept the requested data packet;

[0017] Transforming the data packet and replaying the transformed data packet;

[0018] After the data is replayed, a login request is sent to the Nacos login page, and the custom username and password parameters are passed in for login;

[0019] If the login is successful, use the crawler script to crawl the YML format file in the configuration list of the Nacos configuration management page to the local computer;

[0020] Parse the YML format file of Nacos on the local computer and extract sensitive information from the file;

[0021] Generate a Nacos YML file sensitive information detection report based on the extracted sensitive information.

[0022] In combination with the second aspect, the detecting the network reachability of each IP address in the IP address list includes sending an ICMP request packet to each IP address through Ping scanning, and determining the network reachability of the IP address according to the response information.

[0023] In combination with the second aspect, if there is a network-reachable IP address, detecting all ports of the IP address includes scanning all ports of the target IP address through TCP SYN scanning and / or TCP Connect scanning, and recording them in order from 1 to 65535.

[0024] In combination with the second aspect, the service classification by identifying the services running under the open port includes sending a preset data packet to the open port, analyzing the response information by calling the Nmap database, and identifying the type of the running service.

[0025] In conjunction with the second aspect, the transforming the data packet and replaying the transformed data packet includes:

[0026] Transform the Get request of the data packet into a Post request;

[0027] Change the Nacos service user information path to / nacos / v1 / auth / users? username=username&password=password, where username and password are custom parameters for the detector;

[0028] Add Content-Type:application / x-www-form-urlencoded to indicate the type information in the specific request to the server, and encode the form data of the post request into a key / value format and send it to the server. ;

[0029] Pass in path parameters pageNo=1&pageSize=9;

[0030] Replay the modified data packets.

[0031] In combination with the second aspect, after the data is replayed, a login request is sent to the login page of Nacos, and the custom username and password parameters are passed in for login, including through the mitmproxy library of python, as a middleman traffic proxy tool, to complete the data replay of the data packet.

[0032] In combination with the second aspect, the parsing of the YML format file of Nacos on the local computer to extract sensitive information from the file includes using a Python script to read the YML file content, matching functions through a match function, and recursively searching for sensitive information in the YML file.

[0033] According to a third aspect of the present disclosure, an electronic device is provided, including:

[0034] one or more processors;

[0035] A storage unit is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors can implement any of the above-mentioned methods for detecting unauthorized access vulnerabilities in Nacos.

[0036] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any one of the above methods for detecting unauthorized access vulnerabilities in Nacos can be implemented.

[0037] The present invention provides a detection system, method, electronic device and storage medium for Nacos unauthorized access vulnerability. The target IP address list is received by a scanning module, the network accessibility of each IP address is detected, and its open port is detected. By identifying the open port service type, it is determined whether it is a Nacos Web service. If the Nacos Web service is detected, the system initiates a request for the user information path, and after intercepting the data packet, the request type and parameters of the data packet are transformed, the data is replayed, the account is registered using the vulnerability, and the configuration file in Nacos is crawled. Subsequently, the parsing module parses the crawled YML format file to extract sensitive information. Finally, a vulnerability detection report is generated to help users quickly identify and repair the unauthorized access vulnerability of the Nacos system. The system realizes the automatic detection and analysis of vulnerabilities, improves the detection efficiency and reduces the complexity of manual operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a structural diagram of a system for detecting unauthorized access vulnerabilities in Nacos according to an embodiment of the present disclosure;

[0039] Figure 2 A flowchart of a method for detecting unauthorized access vulnerabilities in Nacos according to an embodiment of the present disclosure;

[0040] Figure 3 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0041] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the embodiments of the present disclosure.

[0042] The terms used in the disclosed embodiments are only for the purpose of describing specific embodiments and are not intended to limit the disclosed embodiments. The singular forms of "a", "said" and "the" used in the disclosed embodiments and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0043] It should be understood that although the terms first, second, third, etc. may be used to describe various information in the disclosed embodiments, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the disclosed embodiments, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0044] like Figure 1 FIG. 1 is a schematic diagram of the structure of a system for detecting unauthorized access vulnerabilities in Nacos according to an embodiment of the present disclosure. The system includes:

[0045] The scanning module 110 is used to receive a target IP address list, detect the network reachability of each IP address in the IP address list, record the open port number, identify the service running under the open port, and classify the service;

[0046] The request module 120 is used to transform the Get request of the data packet into a Post request and complete the request replay of the data packet;

[0047] The parsing module 130 is used to parse the YML file in the configuration list of the Nacos configuration management page and detect sensitive information in the YML file;

[0048] The detection report module 140 is used to generate a Nacos YML file sensitive information detection report according to the sensitive information extracted from the YML file.

[0049] Specifically, the scanning module 110 is used to receive a list of target IP addresses and detect the network reachability of each IP address. The specific operation includes detecting whether each IP address can be accessed through Ping scanning. When it is confirmed that a certain IP address is reachable, the scanning module further detects its open port number, identifies the service running on the open port, and classifies the service. For example, if it is identified that the Nacos Web service is running, the next step of vulnerability detection is entered.

[0050] The request module 120 is used to transform the intercepted HTTP request packet from the original GET request to a POST request. The purpose of this transformation is to simulate the request process in the Nacos system and create an unauthorized user account by sending a custom username and password registration request to the system. The request module processes the data packet, adds appropriate parameters and content types (such as Content-Type: application / x-www-form-urlencoded) to make it conform to the format requirements of the Nacos service, and completes the request replay of the data packet. The core of this step is to exploit the unauthorized access vulnerability of Nacos and perform registration or other operations of unauthorized users by replaying the data packet.

[0051] After successfully exploiting the vulnerability to register an account or perform other operations, the parsing module 130 is responsible for crawling the configuration list in the Nacos configuration management page, especially the YML format file. The YML file usually contains sensitive information such as system configuration parameters, database connection information, API keys, etc. The parsing module will perform in-depth parsing on these files to extract sensitive data such as user names, passwords, API keys, etc., so as to identify potential risks in the system.

[0052] The detection report module 140 summarizes the sensitive information extracted by the parsing module and generates a detailed Nacos YML file sensitive information detection report. The detection report not only lists the discovered vulnerabilities and their corresponding sensitive information, but also classifies and assesses the risks of these vulnerabilities and provides repair suggestions. This report can help system administrators quickly locate problems and take corresponding repair measures to ensure the security of the system.

[0053] The scanning module serves as the initial detection step, ensuring that the system only detects vulnerabilities for valid, network-reachable target IP addresses, saving resources and improving detection efficiency.

[0054] The request module is the key to the system's exploitation of the Nacos vulnerability. It can simulate unauthorized user requests by modifying HTTP request packets and break through the protection layer of unauthorized access.

[0055] The parsing module focuses on analyzing configuration files and extracting key information, which helps to reveal potential risks of the system.

[0056] The test report module systematizes the test results by generating professional reports, and provides valuable references for the repair process, helping companies take timely actions.

[0057] Beneficial effects: The system as a whole realizes the automated detection and analysis of Nacos unauthorized access vulnerabilities, greatly improving the detection efficiency. It also helps users fully understand the system's security risks and their impacts through in-depth analysis of YML configuration files.

[0058] like Figure 2 FIG. 1 is a flow chart of a method for detecting unauthorized access vulnerabilities in Nacos according to an embodiment of the present disclosure. The method includes:

[0059] S201: Input a target IP address list to a scanning module, and detect the network reachability of each IP address in the IP address list;

[0060] S202: If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers;

[0061] S203: Classifying services by identifying services running under open ports;

[0062] S204: If the service is classified as a Nacos Web service, a Get request is initiated to the user information path of the Nacos service / nacos / v1 / auth / users?pageNo=1&pageSize=9;

[0063] S205: If the request is successful, intercept the requested data packet;

[0064] S206: transforming the data packet and replaying the transformed data packet;

[0065] S207: After the data is replayed, a login request is sent to the Nacos login page, and the custom user name and password parameters are passed in for login;

[0066] S208: If the login is successful, use the crawler script to crawl the YML format file in the configuration list of the Nacos configuration management page to the local computer;

[0067] S209: Parse the YML format file of Nacos on the local computer to extract sensitive information from the file;

[0068] S210: Generate a Nacos YML file sensitive information detection report based on the extracted sensitive information.

[0069] Specifically, S201 inputs a target IP address list into a scanning module to detect the network reachability of each IP address in the IP address list.

[0070] By entering a set of target IP addresses, the system will detect the network reachability of each IP address in turn. Network reachability detection usually uses Ping scanning or other network protocols, such as ICMP requests, to determine whether the target IP address is online. If the target responds to the Ping request, it means that the target system can be accessed and further detected.

[0071] S202: If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers.

[0072] When an IP address is detected to be reachable, the system will then scan all ports of the IP address. Port scanning can use TCP SYN scanning or TCP Connect scanning to detect all ports from 1 to 65535 one by one. The open port number will be recorded to further determine the type of service it is running.

[0073] S203: Classify the services by identifying the services running under the open ports.

[0074] Once an open port is identified, the system will further detect the type of service running on the port. By sending a preset data packet and analyzing the response of the port, the system can identify common service types, such as HTTP, FTP, Nacos, etc. In the present invention, it is particularly necessary to identify the Nacos Web service for specific detection in the subsequent steps.

[0075] S204: If the service is classified as a Nacos Web service, a Get request is initiated to the user information path of the Nacos service / nacos / v1 / auth / users?pageNo=1&pageSize=9.

[0076] When it is detected that the target system is running the Nacos Web service, the system will initiate a GET request to the Nacos user information path to try to obtain the list of users registered in the system. This is achieved by accessing the / nacos / v1 / auth / users path, and the paging parameters pageNo=1 and pageSize=9 passed in indicate that the user information of the first page is obtained.

[0077] S205: If the request is successful, intercept the requested data packet.

[0078] If the GET request is successful, the system will intercept the data packet of the request. The data packet contains the user information returned by the Nacos service. The intercepted data packet will be used for subsequent data replay operations to try to simulate vulnerability attacks.

[0079] S206: Transform the data packet and replay the transformed data packet.

[0080] Based on the intercepted data packets, the system will transform them from GET requests to POST requests in order to send customized user registration information to the Nacos server. This process includes modifying the path of the data packet, adding necessary parameters (such as username and password), and adjusting the content type of the request to application / x-www-form-urlencoded. After the transformation is completed, the system resends the request to the Nacos service by replaying the data and tries to register a new user.

[0081] S207: After the data is replayed, a login request is sent to the Nacos login page, and the custom user name and password parameters are passed in for login.

[0082] After the data is replayed successfully, the system will initiate a login request to the Nacos login page and use the custom username and password previously registered in the data replay to log in. Through this operation, the detector can confirm whether the authorization mechanism has been successfully bypassed and an account with unauthorized access has been created.

[0083] S208: If the login is successful, use the crawler script to crawl the YML format file in the configuration list of the Nacos configuration management page to the local computer.

[0084] If the login is successful, it indicates that there is an unauthorized access vulnerability. At this point, the system uses the crawler script to access the Nacos configuration management page and download the YML format file in the configuration list. The YML file usually contains the system configuration information, including database connection, application configuration, etc., which may leak sensitive data.

[0085] S209: Parse the YML format file of Nacos on the local computer to extract sensitive information from the file.

[0086] The YML file downloaded to the local computer will be parsed by the system. The parsing process uses matching algorithms or scripts to extract sensitive information from the file, such as database usernames, passwords, API keys, etc. The extracted sensitive information will be used to evaluate the security of the system.

[0087] S210: Generate a Nacos YML file sensitive information detection report based on the extracted sensitive information.

[0088] Finally, the system will generate a detailed detection report based on the extracted sensitive information. The report includes vulnerability details, extracted sensitive information, risk assessment, and repair suggestions to help system administrators better understand the severity of the vulnerability and patch the system in a timely manner.

[0089] The network detection and port scanning phase aims to find the availability of the target server and identify its open services, ensuring that the detection process only targets the real Nacos service system.

[0090] The data replay phase is the key to the entire vulnerability exploit. By modifying and resending the request packet, the system can bypass Nacos's authentication mechanism and create unauthorized user accounts.

[0091] The crawler and parsing stage further mines sensitive information in the system. By crawling and parsing YML files through automated scripts, potential risks of the system can be effectively identified.

[0092] The report generation step summarizes the results of the entire detection process and provides detection findings and security recommendations.

[0093] Further, the step of transforming the data packet and replaying the transformed data packet includes:

[0094] Convert Get request to Post request: There are many types of HTTP requests, the most commonly used of which are Get and Post. Get request is usually used to obtain data from the server, while Post request is used to send data to the server. By converting the Get request of the data packet into a Post request, the purpose is to convert from simple data reading to data submission.

[0095] After being transformed into a POST request, the detection method can more aggressively send custom data (such as username and password) to the server to test whether the server can accept this data without authorization.

[0096] By forcing the request to be changed to POST, you can better simulate the actual attack scenario and verify whether the server has improper configuration or vulnerabilities.

[0097] Modify the Nacos service user information path: In this step, the original Nacos user information path is modified to a custom path containing the username and password. These custom parameters are set by the detector to simulate the behavior of a malicious user trying to create or obtain a new account.

[0098] The modification of the path makes the request have a specific goal, that is, submitting new user information (user name and password) to the Nacos service. This step is to test whether the Nacos service will accept these parameters without authorization and create or modify user information.

[0099] Through this path modification, the detector can simulate different attack scenarios, such as trying to create a high-privileged administrator account, or testing whether an existing low-privileged account can escalate permissions through this path. This customized path modification makes the detection more targeted and effective.

[0100] Add Content-Type: application / x-www-form-urlencoded Explanation Content-Type is part of the HTTP request header and is used to specify the data format of the request body. Here, it is set to application / x-www-form-urlencoded, which means that the data in the request body will be encoded in key / value pairs for form submission.

[0101] In many web applications, improperly validated Content-Type may lead to security vulnerabilities, such as cross-site scripting (XSS) or request forgery (CSRF). In Nacos's detection, ensuring that the correct Content-Type is used helps test whether the server performs appropriate security processing on different types of request headers.

[0102] Passing in path parameters pageNo=1&pageSize=9: This step adds paging parameters to the request path to specify the requested page number (pageNo) and the amount of data per page (pageSize). In this case, pageNo is set to 1 and pageSize is set to 9.

[0103] Paging parameters are usually used to control the amount of data returned to avoid getting too much data at one time, thereby reducing server load. The paging parameters here are set to ensure that the request complies with the paging logic of the Nacos service.

[0104] By adjusting the paging parameters, the tester can simulate different request scenarios in actual testing. For example, gradually increasing the pageSize and observing the server's response behavior can help discover possible paging processing vulnerabilities or data leakage risks.

[0105] Replay the modified data packets: Data replay is an attack technique where the attacker captures and resends the original data packets in an attempt to gain unauthorized access. Here, the modified data packets are replayed to verify whether the Nacos service has unauthorized vulnerabilities.

[0106] Data replay is designed to test whether the Nacos server can identify and block repeated malicious requests. By replaying the data packets, it can be found whether the server has a protection mechanism for repeatedly processing the same request, such as whether the same request packet is properly timestamped or unique.

[0107] By replaying packets with different variations multiple times, you can further test the server's defense capabilities and assess its vulnerability to actual attacks.

[0108] After the data is replayed, a login request is sent to the login page of Nacos, and the custom username and password parameters are passed in to log in, including through the mitmproxy library of python, which is used as a middleman traffic proxy tool to complete the data replay of the data packet.

[0109] Send a login request after data replay: After data replay is completed, a login request is sent to the Nacos login page. The request contains the custom username and password parameters to verify whether the server allows login to the system through replay.

[0110] After replaying the data packets, sending a login request can test whether the server can correctly handle repeated and possibly tampered login attempts. By customizing the username and password parameters, the detector can further check whether the Nacos service has unauthorized access vulnerabilities or account creation vulnerabilities.

[0111] The sending of login requests not only verifies the effectiveness of the replay attack, but may also reveal other security issues, such as weak password policies, lack of multi-factor authentication (MFA) protection, or improper handling of repeated requests. By attempting to log in, the detector can find out whether the system has default accounts, easily guessed passwords, or other unprotected accounts.

[0112] Using Python's mitmproxy library: mitmproxy is a powerful Man-in-the-Middle (MITM) proxy tool that is often used to intercept, modify, and replay HTTP / HTTPS traffic. Here, the mitmproxy library is used to capture and modify data packets and then replay them to the target server.

[0113] Through mitmproxy, the detector can embed a custom username and password in the request sent to the Nacos service, and further modify these requests during the replay process. This method can effectively simulate a man-in-the-middle attack and test the server's anti-attack capabilities without directly contacting the server.

[0114] In addition to intercepting and modifying HTTP traffic, the mitmproxy library can also be used for more complex protocol analysis and replay such as WebSocket and TLS encrypted traffic. Therefore, it is not only suitable for vulnerability detection of Nacos services, but can also be extended to security assessment of other Web applications, APIs, and services.

[0115] As a middleman traffic proxy tool: In network security, a man-in-the-middle attack is an attack method in which an attacker steals information or injects malicious content by intercepting and possibly modifying data packets transmitted between two parties. Mitmproxy is used as a traffic proxy tool here, acting as a middleman to capture and manipulate the communication between the client and the Nacos service.

[0116] As a man-in-the-middle traffic proxy, mitmproxy can not only intercept and modify data packets in transit, but also replay them to simulate attacks. This is very helpful for detecting whether the Nacos service handles requests correctly, whether there is authentication bypass, whether there is a request duplication problem, etc.

[0117] In actual applications, man-in-the-middle proxy tools such as mitmproxy are not limited to vulnerability detection, but can also be used for debugging, traffic analysis, data desensitization, and even automated testing. By simulating various real-world attack scenarios, detectors can evaluate the overall security of the system and identify potential attack vectors.

[0118] The parsing of the YML format file of Nacos on the local computer to extract sensitive information from the file includes using a Python script to read the YML file content, matching functions through a match function, and recursively searching for sensitive information in the YML file.

[0119] Parse the YML format file of Nacos on the local computer: This part refers to analyzing the YML format file obtained from the Nacos configuration management page in the local environment. Parsing usually involves interpreting the structure of the file in order to identify the information contained in it.

[0120] YML (YAML) is a data serialization format, commonly used in configuration files. It represents data in a simple and human-readable form. Parsing a YML file means loading its contents into memory so that the computer can access and manipulate the data programmatically.

[0121] YML file parsing is a key step in many configuration management and automation tasks. By parsing YML files, detectors can automatically identify potential problems in the configuration, especially those sensitive configuration information that may affect security. In addition, the structure of the YML file makes it particularly suitable for representing nested data, and the hierarchical structure of the file needs to be paid attention to when parsing.

[0122] Reading YML file contents using Python script: This is done by loading an appropriate Python library, such as pyyaml, which is specifically designed to handle the YAML file format.

[0123] Through Python scripts, detectors can automatically load YML files and convert their contents into Python data structures (such as dictionaries and lists) for further analysis and processing. This method is not only fast, but also can process large-scale data and reduce errors in manual processing.

[0124] In practical applications, the operations of reading YML files can include file reading, parsing error handling, multi-file processing, and conversion with other configuration file formats (such as JSON, XML). In addition, Python scripts can also be combined with other tools and libraries, such as regular expressions or natural language processing libraries, to perform deeper analysis on the parsed data.

[0125] Recursively search for sensitive information in YML files through the match function: The match function usually refers to a regular expression matching function, which is used to find strings that match a given pattern in a text. Recursive search means that the function automatically traverses all levels in the YML file to find all possible sensitive information.

[0126] Sensitive information may include database usernames and passwords, API keys, access tokens, etc. In YML files, this information is usually stored in plain text. Regular expression matching can be used to efficiently identify these sensitive data and extract or protect them.

[0127] The concept of recursive search means that the script not only searches for surface data in the YML file, but also goes deep into each nested level of the file. This is especially important for complex configuration files, because sensitive information may be deeply hidden in nested key-value pairs. In addition, the flexibility of regular expressions allows the detector to define different matching patterns according to different types of sensitive information, improving the accuracy of the search.

[0128] Extracted sensitive information: Extraction means separating the identified sensitive data from the YML file and storing or reporting it.

[0129] The extracted sensitive information can be used for a variety of purposes, such as generating security reports, reminding users to protect this information, or reviewing security vulnerabilities in the configuration management system in a larger scope. The extraction process is usually accompanied by classification and tagging of the data for subsequent processing.

[0130] The process of extracting sensitive information can be further integrated into automated security audits and compliance checks. The extracted information can not only help discover current security issues, but can also be used to build risk assessment models based on historical data. In addition, the extracted sensitive information can also be used to trigger alerts or automated repair procedures to further strengthen the security of the system.

[0131] The embodiments of the present disclosure provide a detection system, method, electronic device and storage medium for unauthorized access vulnerabilities in Nacos. The system receives a list of target IP addresses through a scanning module, detects the network reachability of each IP address, and detects its open ports. By identifying the service type of the open port, it determines whether it is a Nacos Web service. If a Nacos Web service is detected, the system initiates a request for the user information path, intercepts the data packet, transforms the request type and parameters of the data packet, replays the data, registers an account using the vulnerability, and crawls the configuration file in Nacos. Subsequently, the parsing module parses the crawled YML format file to extract sensitive information. Finally, a vulnerability detection report is generated to help users quickly identify and repair unauthorized access vulnerabilities in the Nacos system. The system realizes automated detection and analysis of vulnerabilities, improves detection efficiency and reduces the complexity of manual operations.

[0132] The electronic device 300 may be a desktop computer, a notebook, a PDA, a cloud server, or other electronic device. The electronic device 300 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of the electronic device 300 and does not constitute a limitation of the electronic device 300. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0133] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0134] The memory 302 may be an internal storage unit of the electronic device 300, for example, a hard disk or memory of the electronic device 300. The memory 302 may also be an external storage device of the electronic device 300, for example, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 300. Further, the memory 302 may also include both an internal storage unit of the electronic device 300 and an external storage device. The memory 302 is used to store the computer program 303 and other programs and data required by the electronic device. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0135] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present disclosure. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0136] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0137] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0138] In the embodiments provided in the present disclosure, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. Multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection of devices or units, which may be electrical, mechanical or other forms.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0141] If the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present disclosure implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. The computer program may include computer program code, and the computer program code may be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electric carrier signals and telecommunication signals.

[0142] The above embodiments are only used to illustrate the technical solutions of the present disclosure, rather than to limit them. Although the present disclosure has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be included in the protection scope of the present disclosure.

Claims

1. A detection system for unauthorized access vulnerabilities in Nacos. It is characterized in that include: A scanning module is used to receive a target IP address list, detect the network reachability of each IP address in the target IP address list, record the open port number, identify the service running under the open port, and classify the service; The request module is used to transform the Get request of the data packet into a Post request and complete the request replay of the data packet; The parsing module is used to parse the YML file in the configuration list of the Nacos configuration management page and detect sensitive information in the YML file; The detection report module is used to generate a Nacos YML file sensitive information detection report based on the sensitive information extracted from the YML file.

2. A method for detecting unauthorized access vulnerabilities in Nacos. It is characterized in that include: Input a target IP address list into the scanning module, and detect the network reachability of each IP address in the IP address list; If there is an IP address that is reachable on the network, detect all ports of the IP address and record the open port numbers; Classify services by identifying services running under open ports; If the service is classified as Nacos's Web service, initiate a Get request to the user information path of the Nacos service at / nacos / v1 / auth / users?pageNo=1&pageSize=9; If the request is successful, intercept the requested data packet; Transforming the data packet and replaying the transformed data packet; After the data is replayed, a login request is sent to the Nacos login page, and the custom username and password parameters are passed in for login; If the login is successful, use the crawler script to crawl the YML format file in the configuration list of the Nacos configuration management page to the local computer; Parse the YML format file of Nacos on the local computer and extract sensitive information from the file; Generate a Nacos YML file sensitive information detection report based on the extracted sensitive information.

3. The method according to claim 2, It is characterized in that The step of transforming the data packet and replaying the transformed data packet comprises: Transform the Get request of the data packet into a Post request; Change the Nacos service user information path to / nacos / v1 / auth / users? username=username&password=password, where username and password are custom parameters for the detector; Add Content-Type: application / x-www-form-urlencoded to indicate the type information in the specific request to the server, and encode the form data of the post request into a key / value format and send it to the server; Pass in path parameters pageNo=1&pageSize=9; Replay the modified data packets.

4. The method according to claim 2, It is characterized in that After the data is replayed, a login request is sent to the login page of Nacos, and the custom username and password parameters are passed in to log in, including through the mitmproxy library of python, which is used as a middleman traffic proxy tool to complete the data replay of the data packet.

5. The method according to claim 2, It is characterized in that The parsing of the YML format file of Nacos on the local computer to extract sensitive information from the file includes using a Python script to read the YML file content, matching functions through a match function, and recursively searching for sensitive information in the YML file.

6. An electronic device, It is characterized in that include: one or more processors; A storage unit, used to store one or more programs, when the one or more programs are executed by the one or more processors, can enable the one or more processors to implement the method for detecting unauthorized access vulnerabilities in Nacos according to any one of claims 2 to 5.

7. A computer-readable storage medium having a computer program stored thereon, It is characterized in that When the computer program is executed by a processor, it can implement the method for detecting unauthorized access vulnerabilities in Nacos according to any one of claims 2 to 5.

Images