Skip to content
Log inStart free trial

GHSA-m69r-9g56-7mv8 BIT-consul-2022-40716 CVE-2022-40716 GO-2022-1029

HashiCorp Consul vulnerable to authorization bypass

Medium Go
Severity
6.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
1.09%
Chance of exploitation in the next 30 days. Higher than 65.37% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-252 Unchecked Return Value
Fix
1.11.9
Upgrade github.com/hashicorp/consul to this version or later

Description

HashiCorp Consul and Consul Enterprise versions prior to 1.11.9, 1.12.5, and 1.13.2 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. A specially crafted CSR sent directly to Consul’s internal server agent RPC endpoint can include multiple SAN URI values with additional service names. This issue has been fixed in versions 1.11.9, 1.12.5, and 1.13.2. There are no known workarounds.

Affected versions

Go

PackageVulnerableFixed in
github.com/hashicorp/consul
< 1.11.9
1.11.9
github.com/hashicorp/consul
>= 1.12.0, < 1.12.5
1.12.5
github.com/hashicorp/consul
>= 1.13.0, < 1.13.2
1.13.2
github.com/hashicorp/consul
< 1.11.9
>= 1.12.0, < 1.12.5
>= 1.13.0, < 1.13.2
1.11.9
1.12.5
1.13.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/hashicorp/consul Go → 1.11.9

go
go get github.com/hashicorp/consul@v1.11.9 && go mod tidy

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Weakness

CWE-252: Unchecked Return Value

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

How to prevent it
  • Implementation: Check the results of all functions that return a value and verify that the value is expected.
  • Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
  • Implementation: Ensure that you account for all possible return values from the function.
  • Implementation: When designing a function, make sure you return a value or throw an exception in case of an error.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-cpfq-66p2-336j
Consul is vulnerable to arbitrary file read when configured with Kubernetes authentication
Medium Also affects github.com/hashicorp/consul
GHSA-qh7p-pfq3-677h
Consul event endpoint is vulnerable to denial of service
Medium Also affects github.com/hashicorp/consul
GHSA-7g3r-8c6v-hfmr
Consul key/value endpoint is vulnerable to denial of service
Medium Also affects github.com/hashicorp/consul
GHSA-99wr-c2px-grmh
Hashicorp Consul Cross-site Scripting vulnerability
Medium Also affects github.com/hashicorp/consul
GHSA-5c4w-8hhh-3c3h
Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability
Medium Also affects github.com/hashicorp/consul
GHSA-chgm-7r52-whjj
Hashicorp Consul Path Traversal vulnerability
Medium Also affects github.com/hashicorp/consul
GHSA-6m72-467w-94rh
Privilege Escalation in HashiCorp Consul
Medium Also affects github.com/hashicorp/consul
GHSA-496g-fr33-whrf
Denial of service in HashiCorp Consul
High Also affects github.com/hashicorp/consul
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor