Consul Envoy Extension Downsteam Proxy Configuration By Upstream Service Owner
CVE-2023-2816

8.7HIGH

Key Information:

Vendor
Hashicorp
Status
Consul
Consul Enterprise
Vendor
CVE Published:
2 June 2023

Summary

A vulnerability exists in Consul and Consul Enterprise that allows users with service:write permissions to exploit Envoy extensions through service-defaults. This misconfiguration enables unauthorized users to alter remote proxy instances that target the designated services. Consequently, even if these users lack the requisite permissions to make changes to the corresponding services, they can still affect the behavior of these services, leading to potential security risks and unauthorized access.

Affected Version(s)

Consul 64 bit 1.15.0

Consul 64 bit 1.15.1

Consul 64 bit 1.15.2

References

https://discuss.hashicorp.com/t/hcsec-2023-16-consul-envo...

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.