CVE-2024-10005

What it actually does

The flaw permits crafted URL paths in L7 traffic intentions to evade HTTP request path-based access rules, allowing unauthorized service-to-service communication that should have been blocked.

Why it matters to the business

Attackers may reach internal services or data that path-based policies were intended to protect, increasing risk of data exposure or unauthorized operations in environments using Consul for service networking.

How an attack unfolds

An attacker identifies services protected by path-based L7 intentions, then submits HTTP requests containing specially formatted URL paths that bypass the intended rules and reach restricted endpoints.

How to fix it

Upgrade hashicorp/consul to the version containing commit e694ba9b3f1c9f440350869e739d534532946920. After upgrade, re-apply and validate all L7 traffic intentions that rely on HTTP path matching.

How to confirm the fix worked

Confirm the running binary reports a commit at or after e694ba9b3f1c9f440350869e739d534532946920. Test enforcement by sending both allowed and disallowed paths through the updated Consul proxy layer and verify expected allow/deny behavior.

Typical attack path

1. Map Consul-managed services and their L7 traffic intention rules
2. Craft HTTP requests using URL paths designed to evade path-based filters
3. Issue the requests from an authorized client or compromised workload
4. Access or manipulate resources that should have been denied

How to detect it

Review Consul proxy access logs and Envoy access logs for requests that reached endpoints previously protected by path-based intentions; correlate with service identity and unusual path patterns.

What your security team should do

• Immediately upgrade all Consul nodes to the fixed commit
• Audit existing L7 intentions for path-based rules and confirm they still enforce correctly post-upgrade
• Enable detailed access logging on Consul proxies and retain logs for at least 90 days
• Review downstream service dependencies to ensure no application-level assumptions about path enforcement were weakened