Inadequate ACL Enforcement in HashiCorp Consul: Potential Information Disclosure
Summary
CVE-2020-7955: HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Affects consul across 2 version ranges.
< 1.7.0+dfsg1-1
>= 65d2c9b51d02e6b14db3da3cb8424ef72e046780, < 1200f25eabc75368484a78698e75f1e61b6ed010
Fixed in 1.7.0+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is a widely used tool for service networking, enabling users to discover and configure services in their infrastructure. It provides features such as service discovery, health checking, and key-value storage. However, versions 1.4.1 through 1.6.2 of Consul and Consul Enterprise have a critical vulnerability where Access Control Lists (ACLs) are not uniformly enforced across all API endpoints, leading to potential unintended information disclosure.
Vulnerability Detail
The vulnerability, identified as CVE-2020-7955, stems from a failure to consistently enforce ACLs across various API endpoints in HashiCorp Consul. This inconsistency can allow unauthorized users to access sensitive information, which could lead to data leaks or unauthorized actions within the system. The vulnerability affects multiple versions of the software, specifically from 1.4.1 to 1.6.2, and was addressed in version 1.6.3.
How To Fix
Minimum fixed version
1.7.0+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade consulTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the API endpoints by implementing stricter network policies or firewall rules until the upgrade can be completed. However, this is not a complete solution and should not replace the necessary upgrade.
Conclusion
The CVE-2020-7955 vulnerability in HashiCorp Consul highlights the importance of consistent ACL enforcement across API endpoints to prevent unauthorized access to sensitive information. Users are strongly advised to upgrade to version 1.6.3 or later to mitigate this risk.
See every vulnerability recorded for consul →
FAQ
CVE-2020-7955 is a vulnerability in HashiCorp Consul that allows unauthorized access to sensitive information due to inadequate enforcement of ACLs across API endpoints.
The affected versions are HashiCorp Consul and Consul Enterprise from 1.4.1 to 1.6.2.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application at Vulert Scanner without signing up.
The CVSS score for CVE-2020-7955 is 5.3, indicating a medium severity level.
If an immediate upgrade is not possible, implement stricter network policies or firewall rules to limit access to the affected API endpoints as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for consul.
