CVE-2022-23650 Use of Hard-coded Cryptographic Key in Netmaker

2022-02-1822:00:12

CWE-321

GitHub_M

www.cve.org

netmaker

cryptographic key

remote server command execution

wireguard

exploitation

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

46.2%

JSON

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.

CNA Affected

[
  {
    "product": "netmaker",
    "vendor": "gravitl",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.8.5"
      },
      {
        "status": "affected",
        "version": ">= 0.9.0, < 0.9.4"
      }
    ]
  }
]