Service Proxy Registration Vulnerability in HashiCorp Consul: CVE-2021-38698
Summary
CVE-2021-38698: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Affects consul versions < a4f67ec2bffec430e6677dc5a449e89b9b56aa13. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HashiCorp Consul is a widely used service mesh solution that provides service discovery, configuration, and segmentation functionality across distributed applications. It enables services to communicate with each other securely and efficiently. However, a vulnerability was discovered in versions 1.10.1 and earlier, where the Txn.Apply endpoint allowed services to register proxies for other services, potentially exposing sensitive service traffic.
Vulnerability Detail
The vulnerability, identified as CVE-2021-38698, arises from the Txn.Apply endpoint in HashiCorp Consul versions 1.10.1 and earlier. This flaw allows services to register proxies for other services, which can lead to unauthorized access to service traffic. Attackers could exploit this vulnerability to intercept or manipulate communications between services, posing significant security risks. The issue is particularly concerning in environments where sensitive data is transmitted between services, as it could lead to data breaches or service disruptions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Txn.Apply endpoint by implementing network policies or firewall rules that limit which services can communicate with it. This can help mitigate the risk until an upgrade can be performed.
Conclusion
CVE-2021-38698 is a significant vulnerability in HashiCorp Consul that allows unauthorized proxy registration, potentially compromising service traffic. Users are strongly advised to upgrade to the latest versions to mitigate risks. Additionally, implementing network restrictions can serve as a temporary measure until an upgrade is feasible.
See every vulnerability recorded for consul →
FAQ
CVE-2021-38698 is a vulnerability in HashiCorp Consul that allows services to register proxies for other services, potentially exposing sensitive service traffic.
The vulnerability affects HashiCorp Consul versions 1.10.1 and earlier. It has been fixed in versions 1.10.2, 1.9.9, and 1.8.15.
Exploitation of this vulnerability could lead to unauthorized access to service traffic, data breaches, and potential service disruptions.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The CVSS score for CVE-2021-38698 is 6.5, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for consul.
