CVE-2022-24685
📋 TL;DR
This vulnerability in HashiCorp Nomad allows attackers to submit specially crafted HCL job configurations to the jobs parse endpoint, causing excessive CPU consumption and potential denial of service. It affects Nomad and Nomad Enterprise deployments running vulnerable versions. Organizations using affected versions for job orchestration are at risk.
💻 Affected Systems
- HashiCorp Nomad
- HashiCorp Nomad Enterprise
📦 What is this software?
Nomad by Hashicorp
Nomad by Hashicorp
Nomad by Hashicorp
Nomad by Hashicorp
Nomad by Hashicorp
Nomad by Hashicorp
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through CPU exhaustion, rendering Nomad cluster unavailable for job scheduling and management.
Likely Case
Degraded performance and intermittent service interruptions affecting job scheduling and execution.
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place.
🎯 Exploit Status
Exploitation requires sending malformed HCL to the parse endpoint; authentication requirements depend on Nomad configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.18, 1.1.12, 1.2.6
Vendor Advisory: https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561
Restart Required: Yes
Instructions:
1. Backup Nomad configuration and data. 2. Download patched version from HashiCorp releases. 3. Stop Nomad service. 4. Install updated binaries. 5. Restart Nomad service. 6. Verify service functionality.
🔧 Temporary Workarounds
Restrict API Access
linuxLimit access to Nomad API endpoints using network firewalls or ACLs.
iptables -A INPUT -p tcp --dport 4646 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 4646 -j DROP
Enable Authentication
allConfigure Nomad ACLs or other authentication mechanisms to restrict API access.
nomad acl bootstrap
Configure ACL policies in Nomad configuration
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Nomad API endpoints from untrusted networks.
- Deploy rate limiting on Nomad API endpoints to mitigate DoS impact.
🔍 How to Verify
Check if Vulnerable:
Check Nomad version: nomad version | grep -E '1\.0\.17|1\.1\.11|1\.2\.5'Check Version:
nomad versionVerify Fix Applied:
Verify version is 1.0.18, 1.1.12, or 1.2.6: nomad version📡 Detection & Monitoring
Log Indicators:
- High CPU usage alerts from monitoring
- Nomad logs showing parse errors or excessive API requests
Network Indicators:
- Unusual traffic patterns to Nomad API port 4646
- Multiple rapid requests to /v1/jobs/parse endpoint
SIEM Query:
source="nomad" AND ("parse" OR "job") AND (error OR cpu_high)🔗 References
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/
- https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561
- https://security.netapp.com/advisory/ntap-20220331-0007/
- https://discuss.hashicorp.com
- https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/
- https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561
- https://security.netapp.com/advisory/ntap-20220331-0007/
