CVE-2021-37219: HashiCorp Consul Privilege Escalation
Summary
CVE-2021-37219: HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Affects consul across 3 version ranges.
< 1.8.15
>= 1.9.0, < 1.9.9
>= 1.10.0, < 1.10.2
Fixed in 1.8.15, 1.9.9 or 1.10.2, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/hashicorp/consul · Go
- github.com/hashicorp/consul · Go
- consul · Debian:11
The same CVE-2021-37219 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is an open-source service mesh solution that provides a distributed, highly available, and scalable platform for service discovery, configuration, and segmentation across microservices. It is widely used in cloud-native environments to facilitate communication between services. However, a vulnerability has been discovered in Consul versions 1.10.1 and below, including Consul Enterprise, that allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, potentially leading to privilege escalation.
Vulnerability Detail
The vulnerability (CVE-2021-37219) in HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. This means that an attacker with a compromised agent certificate can exploit this vulnerability to gain unauthorized access to server resources and perform actions that should only be allowed for server agents. This can lead to various security risks, including unauthorized data access, modification, or disruption of Consul services.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.8.151.8.15 -
>= 1.9.0, < 1.9.91.9.9 -
>= 1.10.0, < 1.10.21.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to upgrade to the latest patched versions of Consul as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents to access server-only functionality, leading to privilege escalation. To mitigate this risk, it is crucial to upgrade to the latest patched versions of Consul. Regularly updating Consul is essential to ensure protection against known vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for consul →
FAQ
HashiCorp Consul is an open-source service mesh solution that provides service discovery, configuration, and segmentation capabilities for microservices in cloud-native environments.
This vulnerability allows non-server agents with a valid certificate to access server-only functionality, potentially leading to privilege escalation. Attackers could gain unauthorized access to server resources and perform actions that should only be allowed for server agents.
Consul versions 1.10.1 and below, including Consul Enterprise, are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Consul versions 1.8.15, 1.9.9, or 1.10.2, which have addressed the issue.
There is no specific workaround mentioned for this vulnerability. Upgrading to the patched versions of Consul is the recommended approach.
Related vulnerabilities
Recent vulnerabilities recorded for consul.
