{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10006", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "state": "PUBLISHED", "assignerShortName": "HashiCorp", "dateReserved": "2024-10-15T17:46:48.500Z", "datePublished": "2024-10-30T21:20:37.011Z", "dateUpdated": "2024-10-31T13:59:13.505Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Consul", "repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "versions": [{"lessThan": "1.20.1", "status": "affected", "version": "1.9.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Consul Enterprise", "repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "versions": [{"changes": [{"at": "1.19.3", "status": "unaffected"}, {"at": "1.18.5", "status": "unaffected"}, {"at": "1.15.15", "status": "unaffected"}], "lessThan": "1.20.1", "status": "affected", "version": "1.9.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.</p><br/>"}], "value": "A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules."}], "impacts": [{"capecId": "CAPEC-220", "descriptions": [{"lang": "en", "value": "CAPEC-220: Client-Server Protocol Manipulation"}]}], "metrics": [{"cvssV3_1": {"baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-644", "description": "CWE-644: Improper Neutralization of HTTP Headers", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-10-30T21:20:37.011Z"}, "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass"}], "source": {"advisory": "HCSEC-2024-23", "discovery": "EXTERNAL"}, "title": "Consul L7 Intentions Vulnerable To Headers Bypass"}, "adp": [{"affected": [{"vendor": "hashicorp", "product": "consul", "cpes": ["cpe:2.3:a:hashicorp:consul:-:*:*:*:enterprise:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.9.0", "status": "affected", "lessThan": "1.20.1", "versionType": "semver"}, {"version": "1.19.3", "status": "unaffected"}, {"version": "1.18.5", "status": "unaffected"}, {"version": "1.15.15", "status": "unaffected"}]}, {"vendor": "hashicorp", "product": "consul", "cpes": ["cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.9.0", "status": "affected", "lessThan": "1.20.1", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-31T13:49:58.696502Z", "id": "CVE-2024-10006", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T13:59:13.505Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10006", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-31T13:49:58.696502Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hashicorp:consul:-:*:*:*:enterprise:*:*:*"], "vendor": "hashicorp", "product": "consul", "versions": [{"status": "affected", "version": "1.9.0", "lessThan": "1.20.1", "versionType": "semver"}, {"status": "unaffected", "version": "1.19.3"}, {"status": "unaffected", "version": "1.18.5"}, {"status": "unaffected", "version": "1.15.15"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*"], "vendor": "hashicorp", "product": "consul", "versions": [{"status": "affected", "version": "1.9.0", "lessThan": "1.20.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-31T13:58:50.297Z"}}], "cna": {"title": "Consul L7 Intentions Vulnerable To Headers Bypass", "source": {"advisory": "HCSEC-2024-23", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-220", "descriptions": [{"lang": "en", "value": "CAPEC-220: Client-Server Protocol Manipulation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "product": "Consul", "versions": [{"status": "affected", "version": "1.9.0", "lessThan": "1.20.1", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}, {"repo": "https://github.com/hashicorp/consul", "vendor": "HashiCorp", "product": "Consul Enterprise", "versions": [{"status": "affected", "changes": [{"at": "1.19.3", "status": "unaffected"}, {"at": "1.18.5", "status": "unaffected"}, {"at": "1.15.15", "status": "unaffected"}], "version": "1.9.0", "lessThan": "1.20.1", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass"}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.", "supportingMedia": [{"type": "text/html", "value": "<p>A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.</p><br/>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-644", "description": "CWE-644: Improper Neutralization of HTTP Headers"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-10-30T21:20:37.011Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10006", "state": "PUBLISHED", "dateUpdated": "2024-10-31T13:59:13.505Z", "dateReserved": "2024-10-15T17:46:48.500Z", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "datePublished": "2024-10-30T21:20:37.011Z", "assignerShortName": "HashiCorp"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:community:*:*:*", "matchCriteriaId": "0D16200E-5F65-48AE-A0A5-FFADA05CA755", "versionEndExcluding": "1.20.1", "versionStartIncluding": "1.4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "4F4529FE-6B11-4CB9-A8A2-A75D10470294", "versionEndExcluding": "1.15.15", "versionStartIncluding": "1.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "36CDCEB8-8B22-4290-9071-81CE3F0F6B95", "versionEndExcluding": "1.18.5", "versionStartIncluding": "1.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "0AB043DB-FC48-4DE7-80BA-EC410ECD44F2", "versionEndExcluding": "1.19.3", "versionStartIncluding": "1.19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:consul:1.20.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "82C595D9-B7F7-487B-A2B4-B85A45DF471C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en Consul y Consul Enterprise (\u201cConsul\u201d) tal que el uso de encabezados en intenciones de tr\u00e1fico L7 podr\u00eda eludir las reglas de acceso basadas en encabezados HTTP."}], "id": "CVE-2024-10006", "lastModified": "2024-11-08T18:10:31.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.7, "source": "security@hashicorp.com", "type": "Secondary"}]}, "published": "2024-10-30T22:15:03.063", "references": [{"source": "security@hashicorp.com", "tags": ["Vendor Advisory"], "url": "https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass"}], "sourceIdentifier": "security@hashicorp.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-644"}], "source": "security@hashicorp.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hashicorp/consul: consul: Consul L7 Intentions Vulnerable To Headers Bypass", "id": "2322858", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2322858"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-644", "details": ["A vulnerability was identified in Consul and Consul Enterprise (\u201cConsul\u201d) such that using Headers in L7 traffic intentions could bypass HTTP header based access rules.", "A flaw was found in HashiCorp Consul and Consul Enterprise. The server response does not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted and can lead to reflected cross-site scripting (XSS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-10006", "package_state": [{"cpe": "cpe:/a:redhat:openshift_devspaces:3::el8", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel8", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2024-10-30T21:20:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-10006\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-10006\nhttps://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass"], "statement": "This vulnerability is rated as important severity because HashiCorp Consul fails to set a Content-Type HTTP header, allowing user inputs to be misinterpreted and potentially leading to reflected cross-site scripting (XSS). This can compromise both confidentiality and integrity, posing a risk to user data and application security, which requires prompt remediation.", "threat_severity": "Important"}