CVE-2020-13170: Local ACL Token Used in Remote Datacenters #8068
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Summary
When token replication is not enabled in a secondary datacenter, attempts to use a local token created in the primary are successful for operations targeting that secondary datacenter. Thus what was meant to be scoped to a single datacenter is valid in other datacenters.
Background
Consul has two types of tokens, Global and Local. Local tokens are meant to only be resolvable and used within a single datacenter. Creation of local tokens is only allowed if either token replication is enabled in a secondary datacenter, or if the datacenter the token is scoped to is the primary. In a typical cluster we expect that either token replication is on in all datacenters or local tokens are not used at all.
Remediation
Steps to remediate: