CVE-2020-12758: 
Consul vulnerability analysis and mitigation

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. This vulnerability (CVE-2020-12758) was introduced in version 1.6.0 and fixed in versions 1.6.6 and 1.7.4. The vulnerability specifically affects the service-router configuration functionality when an entry is created without a destination (HashiCorp Changelog).

The vulnerability occurs when a service-router config entry is created without a destination while using ACL token with service:write permissions. This malformed configuration could trigger a crash in Consul servers. The issue specifically relates to the Connect traffic routing and manipulation at networking layer 7 (e.g., HTTP) functionality introduced in Consul v1.6.0 (GitHub PR).

When exploited, this vulnerability could cause Consul servers to crash, potentially leading to service disruption. The impact is particularly significant as it affects the core routing functionality of the service mesh infrastructure (HashiCorp Changelog).

The vulnerability can be triggered by users with service:write permissions who can create service-router configuration entries. The exploit requires the ability to create a service-router entry without a destination configuration (GitHub PR).

The vulnerability has been fixed in Consul versions 1.6.6 and 1.7.4. Users should upgrade to these or later versions to remediate the issue. The fix involves constructing a default destination if one does not exist in the service-router configuration (HashiCorp Changelog).