Vulnerability identifier: #VU59041

Vulnerability risk: Medium

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-41805

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Consul
Server applications / Other server solutions

Vendor: HashiCorp

Description

The vulnerability allows a remote user to gain unauthorized access to sensitive information.

The vulnerability exists due to improper access restrictions. An ACL token (with the default operator:write permissions) in one namespace can be used for unintended privilege escalation in a different namespace. A remote user can send a specially crafted request and gain unauthorized access to the affected application.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Consul: 1.8.0 - 1.8.16, 1.9.0 - 1.9.10, 1.10.0 - 1.10.3

---

External links
http://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871
http://github.com/hashicorp/consul/releases/tag/v1.10.4
http://github.com/hashicorp/consul/releases/tag/v1.9.11
http://github.com/hashicorp/consul/releases/tag/v1.8.17

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.