CVE-2021-29442: 
Java vulnerability analysis and mitigation

CVE-2021-29442 affects Nacos, a platform designed for dynamic service discovery, configuration, and service management. The vulnerability was discovered in December 2020 and publicly disclosed on April 27, 2021. When using embedded storage (Derby DB), an unauthenticated attacker can execute arbitrary SQL queries through the /derby endpoint, potentially exposing sensitive information (GitHub Lab, GitHub Issue).

The vulnerability exists in the ConfigOpsController's /derby endpoint, which allows unauthenticated users to perform database operations. The code only validates that the SQL query starts with 'select' but does not implement proper authentication checks. This allows attackers to execute arbitrary SELECT queries against the Derby database, potentially accessing sensitive configuration data and user information (GitHub Lab).

The vulnerability allows unauthenticated attackers to access sensitive information stored in the Derby database, including user credentials, permissions, roles, tenant information, and configuration data. This could lead to unauthorized access to administrative functions and sensitive system configurations (GitHub Issue).

The vulnerability was fixed in Nacos version 1.4.1. Users should upgrade to this version or later to address the security issue. The fix includes proper authentication checks for the Derby endpoint (GitHub Lab).