SB2024110123 - Multiple vulnerabilities in HashiCorp Consul and Consul Enterprise

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Path traversal (CVE-ID: CVE-2024-10005)

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.

2) Improper Neutralization of HTTP Headers for Scripting Syntax (CVE-ID: CVE-2024-10006)

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper input validation when processing HTTP requests. A remote non-authenticated attacker can send a specially crafted HTTP request with an arbitrary Host header that will be accepted by the application.

Successful exploitation of the vulnerability may allow an attacker to perform cross-site scripting, cache poisoning or session hijacking attacks.

Remediation

Install update from vendor's website.

References

• https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass
• https://github.com/advisories/GHSA-chgm-7r52-whjj
• https://github.com/hashicorp/consul/releases/tag/v1.20.1
• https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass
• https://github.com/advisories/GHSA-5c4w-8hhh-3c3h