CVE-2023-32077 Netmaker has Hardcoded DNS Secret Key

2023-08-2421:23:14

CWE-321

GitHub_M

www.cve.org

cve-2023-32077

netmaker

dns key

hardcoded

security issue

patched

upgrade

docker image

wireguard

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.089 Low

EPSS

Percentile

94.6%

JSON

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run docker pull gravitl/netmaker:v0.17.1 and docker-compose up -d. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

CNA Affected

[
  {
    "vendor": "gravitl",
    "product": "netmaker",
    "versions": [
      {
        "version": "< 0.17.1",
        "status": "affected"
      },
      {
        "version": ">= 0.18.0, < 0.18.6",
        "status": "affected"
      }
    ]
  }
]