CVE-2024-10006

What it actually does

The flaw permits bypass of HTTP header-based access rules when Headers are used in L7 traffic intentions, allowing unauthorized requests to reach protected services in the Consul service mesh.

Why it matters to the business

Attackers can reach services and data they should be blocked from, increasing risk of unauthorized operations or data exposure across the service mesh until systems are updated.

How an attack unfolds

An attacker identifies services protected by header-based L7 intentions, then issues HTTP requests containing crafted headers that evade the intended access checks, resulting in unauthorized connectivity through the mesh.

How to fix it

Upgrade hashicorp/consul (GIT) to the version containing commit e694ba9b3f1c9f440350869e739d534532946920.

How to confirm the fix worked

Confirm the running Consul binary or source includes commit e694ba9b3f1c9f440350869e739d534532946920, then test enforcement of header-based L7 intentions with both allowed and disallowed requests.

Typical attack path

1. Map services protected by L7 HTTP header intentions
2. Craft and send requests with headers designed to bypass rules
3. Establish unauthorized connections to restricted endpoints

How to detect it

Examine Consul access and intention evaluation logs for requests that reach protected services despite header rules that should have blocked them.

What your security team should do

• Apply the fixed commit to all Consul deployments
• Audit existing L7 traffic intentions for reliance on HTTP headers
• Enable detailed logging of intention evaluations and review for anomalies