CVE-2024-10086

What it actually does

Missing explicit Content-Type header on server responses allows attacker-controlled input to be interpreted by browsers as HTML or JavaScript, enabling reflected cross-site scripting.

Why it matters to the business

Attackers can hijack user sessions, steal credentials, or perform unauthorized actions within affected Consul deployments, increasing risk of data exposure and operational disruption in service discovery environments.

How an attack unfolds

An attacker crafts a malicious URL containing a script payload and tricks a user into accessing it; the server echoes the input without setting a safe Content-Type, causing the victim's browser to execute the script in the context of the Consul UI or API.

How to fix it

Upgrade hashicorp/consul to the fixed commit e694ba9b3f1c9f440350869e739d534532946920 or later release containing the explicit Content-Type header; apply the same update to all Consul Enterprise instances and verify header presence in responses after deployment.

How to confirm the fix worked

After upgrade, inspect HTTP responses from Consul endpoints for an explicit safe Content-Type header such as application/json or text/plain; retest previously vulnerable reflection points with benign payloads to confirm no script execution occurs.

Typical attack path

1. Identify an endpoint in Consul that reflects user input in responses without setting Content-Type
2. Craft a URL embedding a JavaScript payload designed to execute in the browser
3. Deliver the link via phishing, malicious site, or social engineering
4. Victim interaction triggers the reflected response, executing the payload
5. Script performs actions such as cookie theft, form submission, or redirect

How to detect it

Search web server and application logs for requests containing common XSS patterns such as script tags or event handlers reflected in responses; examine browser console errors or unexpected JavaScript execution originating from Consul endpoints.

• reflected script or onerror= payloads in Consul HTTP request URIs
• absence of Content-Type header in responses from /v1/ or UI endpoints
• unexpected eval or document.cookie access in browser contexts tied to Consul domains

What your security team should do

• Prioritize upgrade of all Consul instances to the fixed commit within the next maintenance window
• Implement WAF rules or proxy configurations to enforce Content-Type headers on API responses as a temporary control
• Review and restrict user input reflection in any custom Consul integrations or templates
• Monitor for unusual script execution or unexpected redirects in browser telemetry from Consul UI users