CVE-2024-10086: Hashicorp Consul XSS Vulnerability

CVE-2024-10086 Overview

CVE-2024-10086 is a reflected cross-site scripting (XSS) vulnerability affecting HashiCorp Consul and Consul Enterprise. The server response did not explicitly set a Content-Type HTTP header, allowing user-provided inputs to be misinterpreted by the browser. Attackers can craft malicious requests that cause the browser to render attacker-controlled content as HTML or JavaScript, leading to script execution in the victim's session context. The flaw is categorized under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
An authenticated victim who follows a crafted link can execute attacker-supplied JavaScript in the Consul web context, exposing session data and enabling actions on behalf of the user.

Affected Products

HashiCorp Consul (Community edition)
HashiCorp Consul Enterprise
NetApp products incorporating Consul (per advisory NTAP-20250110-0006)

Discovery Timeline

2024-10-30 - CVE-2024-10086 published to NVD
2025-01-10 - Last updated in NVD database; NetApp advisory NTAP-20250110-0006 published

Technical Details for CVE-2024-10086

Vulnerability Analysis

The vulnerability stems from Consul's HTTP API failing to set an explicit Content-Type response header on certain error or echo paths. When the server omits this header, browsers perform MIME sniffing to determine how to render the response body. Attackers can supply input that gets reflected into the response. The browser then interprets that response as text/html and executes embedded scripts.

Reflected XSS requires user interaction. A victim must click a crafted link or visit an attacker-controlled page that triggers the request. The attack runs in the origin of the Consul UI or API endpoint, allowing the attacker to read cookies accessible to JavaScript, manipulate the DOM, or issue authenticated API calls on behalf of the victim.

The CWE-79 classification confirms the root issue: improper neutralization of input combined with missing response header hardening. The scope-changed CVSS vector indicates the impact extends beyond the vulnerable component into the user's browser context.

Root Cause

The root cause is a missing security-relevant response header. Consul did not assert Content-Type on responses that reflect user-controlled data, leaving MIME-type interpretation to browser heuristics. When combined with reflected input, this allows HTML and JavaScript content to be executed instead of being treated as inert text.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL targeting a Consul HTTP endpoint that reflects request data into the response without a Content-Type header. The attacker delivers the link through phishing, a malicious page, or a chat message. When an authenticated Consul user opens the link, the browser sniffs the response as HTML and runs the embedded payload in the Consul origin.

No verified public exploit code is available for this issue. Refer to the HashiCorp Security Discussion HCSEC-2024-24 for additional technical context.

Detection Methods for CVE-2024-10086

Indicators of Compromise

HTTP requests to Consul endpoints containing reflected payloads with HTML tags such as <script>, <svg>, or <img onerror=> in query strings or path segments.
Consul HTTP responses lacking an explicit Content-Type: application/json or text/plain header on API error paths.
Browser referrer chains showing Consul UI loads originating from untrusted external domains.

Detection Strategies

Inspect web access logs and reverse proxy logs in front of Consul for anomalous query parameters containing HTML or JavaScript syntax.
Deploy web application firewall (WAF) rules that flag responses missing Content-Type headers from /v1/ Consul API paths.
Correlate user-agent activity and outbound DNS lookups from administrative workstations that access the Consul UI.

Monitoring Recommendations

Enable verbose HTTP access logging on Consul servers and forward logs to a centralized analytics platform for pattern review.
Monitor authenticated Consul API calls for unusual sequences originating shortly after a user clicked an external link.
Track Consul agent and server versions across the fleet to confirm patched builds are deployed everywhere.

How to Mitigate CVE-2024-10086

Immediate Actions Required

Upgrade Consul and Consul Enterprise to the fixed versions identified in HashiCorp advisory HCSEC-2024-24.
For NetApp products bundling Consul, review and apply guidance in NetApp Security Advisory NTAP-20250110-0006.
Restrict network exposure of the Consul HTTP API and UI to trusted administrative networks only.

Patch Information

HashiCorp released fixed versions of Consul and Consul Enterprise that explicitly set the Content-Type HTTP header on responses. Operators should consult the vendor advisory for the exact remediated version numbers and apply rolling upgrades following standard Consul upgrade procedures.

Workarounds

Place Consul behind a reverse proxy that injects a strict Content-Type header and a Content-Security-Policy restricting inline script execution.
Configure browsers and proxies to send the X-Content-Type-Options: nosniff header on Consul responses to disable MIME sniffing.
Limit Consul UI access to authenticated administrators on segmented networks and require short-lived session tokens.

bash

# Example reverse proxy hardening (nginx) in front of Consul
location / {
    proxy_pass http://consul-backend:8500;
    proxy_hide_header Content-Type;
    add_header Content-Type "application/json; charset=utf-8" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
}