HCSEC-2022-10

**Bulletin ID:** HCSEC-2022-10 **Affected Products / Versions:** Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4; fixed in 1.9.17, 1.10.10, and 1.11.5. **Publication Date:** April 15, 2022 **Summary** A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5. **Background** Consul provides [health checking](https://www.consul.io/docs/discovery/checks) functionality with several different kinds of checks, one of which can target HTTP endpoints to monitor that status of the service. These checks may be defined in the Consul configuration file, or added at runtime over the HTTP interface. For more information, see the [health checks tutorial](https://learn.hashicorp.com/tutorials/consul/service-registration-health-checks). **Details** An external party reported that HTTP endpoints accessed with a health check could return an HTTP redirect, which may be abused as a vector for server side request forgery (SSRF) from the perspective of the Consul client agent following that redirect. Depending on the context of the usage of this feature, but specifically in a multi-tenant environment where checks may be defined by parties across trust boundaries, this may result in the bypass of application isolation with the Consul client agent health check serving as a proxy to send a request to arbitrary HTTP endpoints. Consul’s [HTTP + Interval health check configuration](https://www.consul.io/docs/discovery/checks#http-interval) now provides a `disable_redirects` option to prohibit this behavior to better service those multi-tenant use cases. This currently defaults to `false`, but the intent is to default this to `true` in a future release so that redirects must explicitly be enabled. **Remediation** Customers should evaluate the risk associated with this issue and consider upgrading to Consul or Consul Enterprise 1.9.17, 1.10.10, and 1.11.5, or newer. Please refer to [Upgrading Consul](https://www.consul.io/docs/upgrading) for general guidance and version-specific upgrade notes. After upgrading, the `disable_redirects` option for relevant HTTP checks should be set to `true`. **Acknowledgement** This issue was identified by the Offensive Security Research Unit at [Ronin](https://ronin.ae/) who reported it to HashiCorp. *We deeply appreciate any effort to coordinate disclosure of security vulnerabilities. For information about security at HashiCorp and the reporting of security vulnerabilities, please see https://hashicorp.com/security.*