Consul Server Panic when Ingress and API Gateways Configured with Peering Connections
Date: 2023-03
Affected: go/github.com/hashicorp/consul
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-0845
CVE-2023-26054
CWE: CWE-200
CWE-476
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. To exploit this vulnerability, an attacker requires access to an ACL token with service:write permissions, and there needs to be at least one running ingress or API gateway that is configured to route traffic to an upstream service.


Mitigations:

Architectural layers (MAESTRO):