CVE-2024-10006 Overview
CVE-2024-10006 affects HashiCorp Consul and Consul Enterprise. The vulnerability allows attackers to bypass HTTP header-based access rules defined in Layer 7 (L7) traffic intentions. Consul operators rely on L7 intentions to enforce service-to-service authorization within a service mesh. When header-matching rules govern access, attackers can craft requests that evade these controls.
The weakness maps to [CWE-644] Improper Neutralization of HTTP Headers for Scripting Syntax and [CWE-116] Improper Encoding or Escaping of Output. HashiCorp disclosed the issue under advisory HCSEC-2024-23.
Critical Impact
Attackers on the network can bypass L7 intention policies that depend on HTTP header matching, enabling unauthorized access to protected services within the Consul service mesh.
Affected Products
- HashiCorp Consul (community edition)
- HashiCorp Consul Enterprise
- HashiCorp Consul Enterprise 1.20.0
Discovery Timeline
- 2024-10-30 - CVE-2024-10006 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10006
Vulnerability Analysis
Consul service mesh supports L7 traffic intentions that enforce access decisions based on HTTP attributes, including header name and value matching. The vulnerability stems from improper handling of HTTP headers during intention evaluation. Crafted requests can evade header-based match conditions and reach destination services that policy intended to block.
The flaw affects authorization enforcement rather than confidentiality or availability. According to HashiCorp's advisory, operators that depend on header matching to permit or deny traffic between mesh services are impacted. Services protected by other intention attributes (such as path or method rules without header dependency) are not affected by this specific bypass.
Root Cause
The root cause is improper neutralization and encoding of HTTP header values during the L7 intention evaluation pipeline [CWE-644, CWE-116]. The matcher does not consistently normalize header representations before comparing them against configured rules. Attackers can supply header formats that evaluate differently in the matcher versus the proxied request forwarded to the backend.
Attack Vector
An unauthenticated network attacker reachable by the Consul mesh ingress can send specially crafted HTTP requests with manipulated header formatting. The request passes the L7 intention evaluator because the header does not match the deny rule, yet downstream handling interprets the header in a way that satisfies access conditions. No user interaction or prior privileges are required.
No verified proof-of-concept code is publicly available. See the HashiCorp Security Advisory HCSEC-2024-23 for authoritative technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2024-10006
Indicators of Compromise
- HTTP requests to mesh services containing duplicate, malformed, or unusually encoded header names that do not match expected client patterns.
- Access logs showing successful requests to services where L7 intentions should have denied the source identity based on header rules.
- Discrepancies between Envoy sidecar access logs and application-level authorization logs for the same request.
Detection Strategies
- Enable verbose logging on Consul Connect sidecar proxies and correlate request headers against configured intention rules.
- Audit consul intention and ServiceIntentions configurations to inventory services that rely on header-based L7 permissions.
- Baseline normal header patterns per upstream service and alert on anomalous header name casing, folding, or duplication.
Monitoring Recommendations
- Forward Envoy proxy access logs and Consul agent logs to a central analytics platform for correlation with mesh identity data.
- Monitor the HashiCorp advisory channel and NetApp PSIRT feed for updated fixed-version guidance.
- Track unexpected service-to-service calls that violate documented intention policies.
How to Mitigate CVE-2024-10006
Immediate Actions Required
- Identify all Consul and Consul Enterprise deployments and inventory L7 intentions that use header match conditions.
- Upgrade affected Consul clusters to the fixed releases listed in HashiCorp Security Advisory HCSEC-2024-23.
- Review service mesh authorization logs for signs of bypass since the vulnerable versions were deployed.
Patch Information
HashiCorp released fixed versions of Consul and Consul Enterprise addressing this bypass. Refer to the HashiCorp Security Advisory for the specific patched version numbers and upgrade guidance. NetApp also published Advisory NTAP-20250110-0005 for affected integrations.
Workarounds
- Replace header-only L7 intention rules with intentions that evaluate stronger attributes such as source service identity, path, and method where feasible.
- Enforce defense-in-depth authorization at the application layer so that bypassing header-based mesh rules does not grant unauthorized access.
- Restrict ingress to Consul mesh services to trusted network ranges until the upgrade is complete.
# Verify Consul version on each agent
consul version
# List configured service intentions for audit
consul config list -kind=service-intentions
consul config read -kind=service-intentions -name=<service-name>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
