CVE-2021-38698: HashiCorp Consul and Consul Enterprise Proxy Registration Vulnerability
Summary
CVE-2021-38698: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Affects consul across 3 version ranges.
< 1.8.15
>= 1.9.0, < 1.9.9
>= 1.10.0, < 1.10.2
Fixed in 1.8.15, 1.9.9 or 1.10.2, depending on the release line you run. How to fix ↓
Also tracked for
- github.com/hashicorp/consul · Go
- github.com/hashicorp/consul · Go
- consul · Debian:11
The same CVE-2021-38698 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is an open-source service mesh solution that provides a distributed and highly available network infrastructure for connecting, securing, and configuring services across any runtime platform and public or private cloud. Consul Enterprise is the commercial version of Consul that offers additional features and support. Consul allows services to register and discover each other, facilitating communication and load balancing. However, a vulnerability in Consul and Consul Enterprise versions 1.10.1 and below allows services to register proxies for other services, granting unauthorized access to service traffic.
Vulnerability Detail
The vulnerability (CVE-2021-38698) in HashiCorp Consul and Consul Enterprise versions 1.10.1 and below arises from the Txn.Apply endpoint, which permits services to register proxies for unrelated services. This enables an attacker to intercept and manipulate service traffic, potentially leading to unauthorized access, data leakage, or service disruption. The vulnerability has a medium severity rating (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). It has been fixed in Consul versions 1.8.15, 1.9.9, and 1.10.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.8.151.8.15 -
>= 1.9.0, < 1.9.91.9.9 -
>= 1.10.0, < 1.10.21.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The vulnerability in HashiCorp Consul and Consul Enterprise versions 1.10.1 and below allows services to register proxies for other services, potentially leading to unauthorized access and data leakage. It is crucial to upgrade to the fixed versions (1.8.15, 1.9.9, or 1.10.2) to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for consul →
FAQ
HashiCorp Consul is an open-source service mesh solution that provides a distributed and highly available network infrastructure for connecting, securing, and configuring services across any runtime platform and public or private cloud.
The vulnerability allows services to register proxies for other services, enabling unauthorized access to service traffic. This can lead to potential data leakage, service disruption, or unauthorized access to sensitive information.
HashiCorp Consul and Consul Enterprise versions 1.10.1 and below are affected by this vulnerability.
To fix the vulnerability, upgrade to Consul version 1.8.15, 1.9.9, or 1.10.2. If you are using Consul Enterprise, upgrade to the corresponding fixed version. Follow the upgrade instructions provided by HashiCorp.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to the fixed version of Consul or Consul Enterprise.
Related vulnerabilities
Recent vulnerabilities recorded for consul.
