HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

highseverity

7.5CVSS score

8.7%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to send crafted requests to internal resources, leading to unauthorized access or information disclosure.

Fix

1) HTTP + interval health check configuration provides a disable_redirects option to prohibit this behavior. 2) Fixed in 1.9.17, 1.10.10, and 1.11.5.

How to confirm it

Send: PUT /v1/agent/check/register ; PUT /v1/agent/check/deregister/{{randstr}}
Positive when: contains "unknown field \"disable_redirects\"" AND status 400

Run it with nuclei: nuclei -id CVE-2022-29153 -u <target>

The full check

id: CVE-2022-29153

info:
  name: HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery
  author: c-sh0
  severity: high
  description: |
    HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send crafted requests to internal resources, leading to unauthorized access or information disclosure.
  remediation: 1) HTTP + interval health check configuration provides a disable_redirects option to prohibit this behavior. 2) Fixed in 1.9.17, 1.10.10, and 1.11.5.
  reference:
    - https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
    - https://github.com/hashicorp/consul/pull/12685
    - https://developer.hashicorp.com/consul/docs/discovery/checks
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29153
    - https://discuss.hashicorp.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-29153
    cwe-id: CWE-918
    epss-score: 0.08746
    epss-percentile: 0.95198
    cpe: cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: hashicorp
    product: consul
    shodan-query:
      - title:"Consul by HashiCorp"
      - http.title:"consul by hashicorp"
      - cpe:"cpe:2.3:a:hashicorp:consul"
    fofa-query: title="consul by hashicorp"
    google-query: intitle:"consul by hashicorp"
  tags: cve,cve2022,consul,hashicorp,ssrf,intrusive,vkev,vuln

http:
  - raw:
      - | # register safe test node
        PUT /v1/agent/check/register HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"id":"{{randstr}}","name":"TEST NODE","method":"GET","http":"http://oast.me","interval":"10s","timeout":"1s","disable_redirects":true}
      - | # deregister test node
        PUT /v1/agent/check/deregister/{{randstr}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - unknown field "disable_redirects"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from