JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access

Vulnerability

CVE-2023-3518 is a vulnerability in HashiCorp Consul and Consul Enterprise 1.16.0 where JWT authentication for service mesh layer 7 intentions incorrectly allows or denies access regardless of the service identity (mTLS certificate). The issue was found during internal testing by the Consul engineering team [3].

Exploitation

The attack surface is specific to Consul deployments that use JWT authentication in the service mesh. An attacker who can craft requests to the mesh may exploit the misconfiguration: when two source intentions that restrict access with different JWT providers are configured, only one JWT validation configuration is used. This can allow some service identities to be incorrectly authenticated with mismatching JWTs [2][3].

Impact

Successful exploitation could allow an attacker to bypass intended access controls. Depending on the network configuration, this could result in unauthorized access to services within the mesh, potentially exposing sensitive data or allowing further network traversal. The vulnerability does not require special privileges beyond the ability to interact with the affected service mesh endpoints [3].

Mitigation

HashiCorp released Consul 1.16.1, which fixes the issue. Users of Consul 1.16.0 are advised to upgrade to 1.16.1 or later. No workarounds are mentioned in the advisory. The vulnerability was internally discovered and reported by HashiCorp's engineering team [3].