# HCSEC-2021-07 - Consul API KV Endpoint Vulnerable to Cross-Site Scripting

**URL:** <https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368>\
**Category:** Security\
**Tags:** security-consul\
**Created:** [April 19, 2021, 10:40pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368 "2021-04-19T22:40:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jfinnigan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jfinnigan/32/3834_2.png) [@jfinnigan](https://discuss.hashicorp.com/u/jfinnigan)\
**Post date:** [April 19, 2021, 10:40pm UTC](https://discuss.hashicorp.com/t/hcsec-2021-07-consul-api-kv-endpoint-vulnerable-to-cross-site-scripting/23368/1 "2021-04-19T22:40:17Z")

</div>

**Bulletin ID:** HCSEC-2021-07  
**Affected Products / Versions:** Consul and Consul Enterprise through 1.9.4; fixed in 1.9.5, 1.8.10 and 1.7.14.  
**Publication Date:** 19 April, 2021

**Summary**  
A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that a specially crafted key-value entry could be used to perform a cross-site scripting (XSS) attack when viewed in Consul KV API’s raw mode. This vulnerability, CVE-2020-25864, affects all Consul versions up to 1.9.4, and is fixed in the 1.9.5, 1.8.10 and 1.7.14 releases.

**Background**  
Consul provides a [key-value store](https://www.consul.io/docs/dynamic-app-config/kv) (“KV”) that allows storage of indexed objects, typically configuration parameters and metadata. The [KV API](https://www.consul.io/api/kv) has an optional [raw](https://www.consul.io/api/kv#raw) mode where a KV-indexed object may be served without a JSON wrapper.

**Details**  
It was discovered that the Consul KV API was vulnerable to cross-site scripting when called with the raw parameter. There are various means by which cross-site scripting vulnerabilities may be used to target a Consul service or the environment/users within which it is situated.

**Remediation**  
Customers should evaluate the risk associated with this issue and consider upgrading to Consul 1.9.5, 1.8.10, 1.7.14, or newer. Please refer to [Upgrading Consul](https://www.consul.io/docs/upgrading) for general guidance and version-specific upgrade notes.

**Acknowledgement**  
This issue was identified by the HashiCorp product security team.

_We deeply appreciate any effort to discover and disclose security vulnerabilities responsibly. For information about security at HashiCorp and the reporting of security vulnerabilities, please see [https://hashicorp.com/security](https://hashicorp.com/security)._