漏洞描述
HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
discuss.hashicorp.comhttps://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393↗github.comhttps://github.com/hashicorp/consul/pull/12685↗developer.hashicorp.comhttps://developer.hashicorp.com/consul/docs/discovery/checks↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-29153↗discuss.hashicorp.comhttps://discuss.hashicorp.com↗