Information Disclosure in Consul-Template via Error Messages

Executive Summary

The consul-template library has an information disclosure flaw in its error handling. When errors occur, Vault secret values may appear in error messages, logs, or systems like Nomad task events. This happens because the secret redaction fails to cover all Vault secret formats. Only deployments using Vault KV v1 secrets are unaffected. The issue is fixed in consul-template 0.43.0.

Useful 0 Not Useful 0

Detection Guidance

Check consul-template logs and error messages for any Vault secret values that appear verbatim. Look for template errors or Nomad task events that may expose secrets. Ensure secret redaction is working correctly by reviewing error handling paths in versions 0.27.2 through 0.42.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could expose sensitive Vault secret values in error logs or messages, potentially leaking confidential information to unauthorized users. If your system relies on consul-template versions 0.27.2 to 0.42.1, attackers might access secret data through error outputs or logs.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to unauthorized exposure of sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Unauthorized secret leakage violates these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade consul-template to version 0.43.0 or later immediately. Review and monitor logs for any exposed secrets. If using Vault KV v1 secrets only, confirm no other secret types are in use that could be affected.

Useful 0 Not Useful 0