Improper Neutralization of Special Elements used in a Command Affecting github.com/hashicorp/consul/agent package, versions <0.9.4>=1.0.0 <1.0.8>=1.1.0 <1.1.1>=1.2.0 <1.2.4


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.19% (59th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Neutralization of Special Elements used in a Command vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-GOLANG-GITHUBCOMHASHICORPCONSULAGENT-6099122
  • published5 Dec 2023
  • disclosed4 Dec 2023
  • creditUnknown

Introduced: 4 Dec 2023

CVE-2023-5332  (opens in a new tab)
CWE-77  (opens in a new tab)

How to fix?

Upgrade github.com/hashicorp/consul/agent to version 0.9.4, 1.0.8, 1.1.1, 1.2.4 or higher.

Overview

github.com/hashicorp/consul/agent is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in a Command via the enable-script-checks option. An attacker can register a check on a remote agent with a malicious payload, allowing service registration with checks enabled via an exposed API presents an RCE

Note: This is only exploitable if enable-script-checks is set to True.

CVSS Scores

version 3.1