CVE-2021-38698

Vulnerability

Consul and Consul Enterprise versions prior to 1.8.15, 1.9.9, and 1.10.2 contain an authorization bypass vulnerability in the Txn.Apply endpoint [1][2][4]. An ACL token with service:write permissions for any service could be used to register a proxy for an arbitrary target service, bypassing the intended ACL checks [4].

Exploitation

An attacker possessing an ACL token with service:write permissions for any service could craft a Txn.Apply request to register a proxy for a different service [4]. The attacker only needs network access to the Consul HTTP API and a valid token with the minimal service:write privilege [4].

Impact

Successful exploitation allows the attacker to intercept mTLS traffic destined for the target service [4]. The proxy receives encrypted traffic meant for the target service, potentially exposing sensitive data and compromising the confidentiality of service-to-service communication [4].

Mitigation

Upgrade to Consul or Consul Enterprise 1.8.15, 1.9.9, or 1.10.2 or later [2][4]. The fix corrects ACL enforcement on the Txn.Apply endpoint to ensure that proxy registrations are properly authorized [1][4]. No workaround is available [4].