CVE-2024-10005: HashiCorp Consul Auth Bypass Vulnerability

CVE-2024-10005 Overview

CVE-2024-10005 affects HashiCorp Consul and Consul Enterprise. The vulnerability allows attackers to bypass HTTP request path-based access rules configured through Layer 7 (L7) traffic intentions. By crafting URL paths that evade the matching logic, an attacker can reach protected upstream services that Consul intentions were intended to restrict.

The issue is classified as a path traversal weakness [CWE-22] and stems from how Consul normalizes and compares URL paths when evaluating L7 intention rules. HashiCorp published the advisory as HCSEC-2024-22, and NetApp issued a downstream advisory (NTAP-20250110-0004) covering products that embed Consul.

Critical Impact
Attackers on the network can bypass path-based service mesh authorization policies, gaining access to upstream HTTP endpoints that should be denied.

Affected Products

HashiCorp Consul (community edition)
HashiCorp Consul Enterprise
HashiCorp Consul Enterprise 1.20.0

Discovery Timeline

2024-10-30 - CVE-2024-10005 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10005

Vulnerability Analysis

Consul provides service mesh functionality with L7 traffic intentions that allow operators to permit or deny traffic based on HTTP attributes, including request paths. Administrators use these intentions to enforce least-privilege access between services communicating through the mesh.

The vulnerability lies in how Consul evaluates HTTP request paths against intention rules. When a request contains a URL path that the matcher does not fully normalize, the request can be routed to a destination that a path-based deny rule was supposed to block. The result is an authorization bypass at the service mesh layer.

The flaw impacts integrity of policy enforcement rather than confidentiality of stored data. An attacker who can send HTTP traffic to a Consul-managed service mesh proxy can reach paths intended for other, more privileged callers. This weakens segmentation between microservices and undermines zero-trust assumptions built on Consul intentions.

Root Cause

The root cause is improper path normalization during L7 intention evaluation, mapped to [CWE-22]. Path segments such as encoded characters, redundant separators, or traversal sequences are compared inconsistently between the intention matcher and the upstream service, producing a mismatch that the attacker exploits.

Attack Vector

The attack is remote and requires no authentication or user interaction. An attacker sends a crafted HTTP request through a Consul service mesh ingress or sidecar proxy. The malformed path evades the deny rule and is forwarded to the backend service, which processes it as a legitimate request. See the HashiCorp Security Advisory HCSEC-2024-22 for the vendor's technical description.

Detection Methods for CVE-2024-10005

Indicators of Compromise

HTTP requests containing encoded traversal characters, redundant slashes, or unusual path segments reaching services protected by L7 intentions.
Access logs on upstream services showing successful responses to paths that Consul intentions should have denied.
Discrepancies between Consul Envoy proxy access logs and upstream application logs for the same request path.

Detection Strategies

Compare Consul intention evaluation logs against upstream service access logs to surface path mismatches where a deny should have applied.
Inspect Envoy sidecar access logs for x-forwarded-uri or original path headers that differ from the normalized path evaluated by the intention.
Alert on any HTTP requests to protected endpoints that originate from source services not listed in an allow intention.

Monitoring Recommendations

Enable verbose access logging on Consul Connect Envoy proxies and forward logs to a centralized SIEM or data lake for correlation.
Baseline expected path patterns per service and alert on outliers, particularly requests containing %2e, %2f, .., or double-slash sequences.
Track Consul agent and proxy versions across the fleet to identify hosts still running unpatched releases.

How to Mitigate CVE-2024-10005

Immediate Actions Required

Inventory all Consul and Consul Enterprise deployments and identify clusters using L7 intentions with path-based rules.
Upgrade Consul and Consul Enterprise to the fixed releases listed in HCSEC-2024-22 as soon as change control permits.
For NetApp products bundling Consul, review the NetApp Security Advisory NTAP-20250110-0004 and apply vendor updates.

Patch Information

HashiCorp released fixed versions of Consul and Consul Enterprise. Refer to the HashiCorp Security Advisory HCSEC-2024-22 for the specific patched version numbers that address CVE-2024-10005. Apply the patch to all Consul servers, agents, and Envoy sidecar proxies to fully remove the bypass condition.

Workarounds

Replace path-based L7 intention rules with source-service identity restrictions where feasible, reducing reliance on path matching.
Enforce path-based authorization at the upstream application layer rather than solely at the Consul intention layer.
Restrict network access to Consul-managed services so that only trusted callers can reach mesh ingress points.

bash

# Configuration example
# Verify installed Consul version and plan upgrade to a fixed release
consul version

# Review L7 intentions that rely on HTTP path matching
consul config read -kind service-intentions -name <service-name>