CVE-2022-29153
Published: 19 April 2022
Summary
CVE-2022-29153 is a high-severity SSRF (CWE-918) vulnerability in Hashicorp Consul. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
HashiCorp Consul and Consul Enterprise versions up to 1.9.16, 1.10.9, and 1.11.4 contain a server-side request forgery vulnerability (CWE-918) in the client agent's handling of HTTP health check endpoints. When a health check returns a redirect, the agent follows it without sufficient restrictions, enabling SSRF. The issue received a CVSS 3.1 score of 7.5 with network attack vector and high integrity impact.
An attacker able to configure or influence an HTTP health check endpoint can supply a redirect that causes the Consul client to issue arbitrary requests to internal or external systems. This can result in unauthorized access to resources reachable from the agent, though authentication or network controls may limit reach in some deployments.
HashiCorp advisory HCSEC-2022-10 and subsequent package updates for Fedora and Gentoo state that the flaw is resolved in Consul 1.9.17, 1.10.10, and 1.11.5; operators are advised to upgrade and review health-check configurations that accept redirects.
EPSS for the CVE sits at a peak of 0.8776 with no indicated rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1808
Vulnerability details
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects returned by HTTP health check endpoints. Fixed in 1.9.17, 1.10.10, and 1.11.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.
Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.
Validates server-side URLs and resource references to block SSRF attempts.
Detects server-side request forgery through monitoring of unexpected outbound connections.