CyberRota Analysis
AI-GeneratedThe vulnerability affects the Steeltoe framework versions 4.0.0 to 4.3.0, specifically in the ConsulDiscoveryClient, which improperly handles secure metadata during the construction of ConsulServiceInstance objects. This flaw allows a malicious actor to register a service with malformed metadata, causing enumeration failures that render the targeted service undiscoverable until the registration is removed. Organizations using affected versions of Steeltoe for cloud-native applications should prioritize upgrading to version 4.3.0 to mitigate potential service outages.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 until 4.3.0, ConsulDiscoveryClient constructs ConsulServiceInstance objects by parsing each registration's secure metadata with a strict Boolean conversion. A principal that can register a Consul service can supply a secure value other than true or false, causing the exception from one instance to abort construction of the entire instance list and make the targeted service undiscoverable. When GetAllInstancesAsync enumerates all services, one malformed instance can abort enumeration across every service. The outage persists until the offending registration is removed. This issue is fixed in version 4.3.0.