There is a common point of confusion between the and the Budget and Expense Tracker System . The latter has been hit with a high-severity Unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2021-35031).
To move from a vulnerable, open instance to a hardened, private NuGet server, follow this checklist:
By default, BaGet's API allows package publishing without any authentication. If you expose your BaGet instance to the internet or a wider network without securing it, an attacker could find your server's /v3/index.json endpoint.
: Vulnerabilities in underlying libraries—such as data compression utilities, database drivers (like Microsoft.Data.SqlClient ), or web hosting modules—can be bundled into the deployment.
Attackers can bypass file type restrictions during the package upload process. By uploading a crafted
Baget connects to hardcoded IP or domain (e.g., 192.168.1.100:2556 ).
By embedding malicious targets into a package's .targets or .props files, the attacker's code executes automatically the moment a developer restores packages or builds the project. This completely bypasses traditional runtime protections, giving the attacker access to environment variables, source code, and cloud credentials. 3. Containerized OS & Database Flaws
: When the internal build server requests the latest version of the package, a default BaGet configuration may favor or fetch the higher-versioned public package. The malicious public package is downloaded and compiled, leading to arbitrary code execution on developer machines or build agents. 2. API Key Exposure and Unauthorized Package Uploads
Use firewall rules to restrict access exclusively to designated CI/CD build agents and developer IP subnets. 2. Enforce Strong Authentication
