CVE-2022-29153

HIGHNuclei

Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2022-29153 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 13, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

consul

Browse hashicorp / consul
VulnCheckVersion data not supplied

github.com/hashicorp/consul

Browse Go / github.com/hashicorp/consul
GitHub AdvisoryBefore 1.9.17 · Fixed in 1.9.17affected
1.10.0 to < 1.10.10 · Fixed in 1.10.10affected
1.11.0 to < 1.11.5 · Fixed in 1.11.5affected

Nuclei templates

1
ProjectDiscoveryHIGHHashiCorp Consul/Consul Enterprise - Server-Side Request ForgeryCVSS 7.5

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to send crafted requests to internal resources, leading to unauthorized access or information disclosure.

Remediation

1) HTTP + interval health check configuration provides a disable_redirects option to prohibit this behavior. 2) Fixed in 1.9.17, 1.10.10, and 1.11.5.

WeaknessesCWE-918
Authorsc-sh0
Template tagscvecve2022consulhashicorpssrfintrusivevkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CPE: cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*
Shodan: title:"Consul by HashiCorp"
Shodan: http.title:"consul by hashicorp"
Shodan: cpe:"cpe:2.3:a:hashicorp:consul"
FOFA: title="consul by hashicorp"
Google: intitle:"consul by hashicorp"
https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393 https://github.com/hashicorp/consul/pull/12685 https://developer.hashicorp.com/consul/docs/discovery/checks https://nvd.nist.gov/vuln/detail/CVE-2022-29153 https://discuss.hashicorp.com/

Source: ProjectDiscovery

References

9