1221 matches found
Man-in-the-Middle (MitM)
github.com/hashicorp/consul is vulnerable to man-in-the-middle. The agent-to-agent RPC communication does not verify the hostname of outgoing connections which results in an insecure plaintext communications channel. This allows an attacker to perform a man-in-the-middle attack against vulnerable...
CVE-2018-19653
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...
UBUNTU-CVE-2018-19653
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...
Design/Logic Flaw
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...
CVE-2018-19653
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...
DEBIAN-CVE-2018-19653
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...
CVE-2018-19653
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...
CVE-2018-19653
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...
CVE-2018-19653
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verifyoutgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade...
CVE-2018-19653
CVE-2018-19653 affects HashiCorp Consul versions 0.5.1 through 1.4.0. The issue enables cleartext agent-to-agent RPC due to the verify_outgoing setting being inadequately documented, as described in the initial entry. Connected sources corroborate the vulnerability and note that vendor-provided r...
PT-2018-15031 · Hashicorp +1 · Hashicorp Consul +1
Name of the Vulnerable Software and Affected Versions: HashiCorp Consul versions 0.5.1 through 1.4.0 Description: The issue arises from the improper documentation of the verify outgoing setting, allowing HashiCorp Consul to use cleartext agent-to-agent RPC communication. This affects versions 0.5...
HashiCorp Consul Detection
Detection of HashiCorp Consul. The script sends a connection request to the server and attempts to detect HashiCorp Consul and to extract its version. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respecti...
Hashicorp Consul Remote Command Execution via Rexec
This module exploits a feature of Hashicorp Consul named rexec. Module Options msf use exploit/multi/misc/consul/rexecexec msf undefinedrexecexec show actions ...actions... msf undefinedrexecexec set ACTION msf undefinedrexecexec show options ...show and set options... msf undefinedrexecexec run...
Hashicorp Consul Remote Command Execution via Services API
This module exploits Hashicorp Consul's services API to gain remote command execution on Consul nodes. Module Options msf use exploit/multi/misc/consul/serviceexec msf undefinedserviceexec show actions ...actions... msf undefinedserviceexec set ACTION msf undefinedserviceexec show options ...show...
Hashicorp Consul Web UI and API access
A remote, unauthenticated attacker may able to access Consul Web UI and API to gather data, register services and gain remote access. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid111351; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...
FreeBSD : consul -- vulnerability in embedded DNS library (ad2eeab6-ca68-4f06-9325-1937b237df60)
Consul developers report : A flaw was found in the embedded DNS library used in consul which may allow a denial of service attack. Consul was updated to include the fixed version. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeB...
consul -- vulnerability in embedded DNS library
Consul developers report: A flaw was found in the embedded DNS library used in consul which may allow a denial of service attack. Consul was updated to include the fixed version...
Cross-site Scripting (XSS)
github.com/hashicorp/consul is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the sessionName, sessionMeta and aclName strings, allowing an attacker to inject and execute arbitrary script...
Brute Force Attacks
github.com/hashicorp/consul is vulnerable to brute force attacks. Consul responds with a 403 when trying to destroy an invalid access token but a 404 when trying to clone an invalid token. Using this flaw an attacker can brute force a valid access token by logging the 403 forbidden responses...