Listen to this Post
Steeltoe’s Consul discovery client constructs `ConsulServiceInstance` objects by parsing the `secure` metadata field from each service registration using bool.Parse. This method strictly accepts only `true` or `false` and throws a `FormatException` for any other value, such as yes, 1, or on. When a single service instance in the Consul catalog is registered with a malformed `secure` value, the exception is thrown during the construction of the entire instance list for that service. The exception aborts the enumeration process, causing the targeted service to become completely undiscoverable to all Steeltoe applications that attempt to resolve it. The outage affects every instance of the targeted service, not just the malformed one, and it persists until the offending registration is removed from the Consul catalog. Furthermore, when the `GetAllInstancesAsync` method is used to enumerate all services, a single malformed instance in any service can abort the enumeration across every service, potentially causing a widespread service-discovery outage. This vulnerability is classified as CWE-755 (Improper Handling of Exceptional Conditions) and has a CVSS v3.1 base score of 7.5, indicating a high severity due to the availability impact. The issue affects Steeltoe.Discovery.Consul versions from 4.0.0 up to but not including 4.3.0, and it is fixed in version 4.3.0. Any principal that can register a service in the Consul catalog can trigger this denial-of-service condition, making it a significant risk in mixed-platform environments where non-.NET clients might register services with non-standard metadata values.
DailyCVE Form:
Platform: Steeltoe Consul
Version: 4.0.0-4.2.0
Vulnerability : DoS via bool.Parse
Severity: High
date: 2026-09-17
Prediction: 2026-09-17
What Undercode Say:
Analytics:
Query Consul catalog for services with malformed secure metadata curl -s http://localhost:8500/v1/catalog/services | jq -r 'to_entries[] | .key as $svc | .value[] | select(.ServiceMeta.secure != null) | select(.ServiceMeta.secure != "true" and .ServiceMeta.secure != "false") | "($svc) (.ServiceID) secure=(.ServiceMeta.secure)"'
// Vulnerable code in ConsulServiceInstance.cs
var metadata = ConsulServerUtils.GetMetadata(serviceEntry);
IsSecure = metadata.TryGetValue("secure", out var secureString) && bool.Parse(secureString);
How Exploit: (Educational Purposes!)
An attacker with the ability to register a service in the Consul catalog can exploit this vulnerability by submitting a service registration with a `secure` metadata value that is not a valid Boolean, such as yes, 1, or on. This malformed registration will cause the `bool.Parse` call to throw an exception when any Steeltoe application attempts to resolve the targeted service. As a result, the service becomes undiscoverable, and if `GetAllInstancesAsync` is used, the exception can abort enumeration across all services, leading to a complete service-discovery outage. The attacker does not require any privileges on the Steeltoe application itself, only the ability to write to the Consul service registration API.
Protection: from this CVE
Upgrade Steeltoe.Discovery.Consul to version 4.3.0 or later, where the issue is fixed. If an immediate upgrade is not possible, audit the Consul catalog for service registrations with non-standard `secure` metadata values and remove or correct them. Restrict write access to the Consul service registration API to trusted services only, and ensure that all Consul service registrations provide valid Boolean values (true or false) for the `secure` metadata field.
Impact:
This vulnerability causes a denial of service by making targeted services undiscoverable through the ConsulDiscoveryClient. The outage affects all instances of the targeted service and can escalate to affect all services when `GetAllInstancesAsync` is used. Availability is impacted until the offending registration is removed. There is no impact on confidentiality or integrity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
