CVE-2022-23650: Gravitl Netmaker hard-coded cryptographic key in server component

Executive brief

Netmaker is a platform used to manage virtual networking and WireGuard-based VPNs. A security flaw exists where a permanent, secret key was accidentally included in the software's code. If an attacker knows an administrator's username and the server's address, they can use this secret key to issue administrative commands, potentially taking full control of the network management server.

Technical details

A Use of Hard-coded Cryptographic Key (CWE-321) and Hard-coded Credentials (CWE-798) vulnerability exists in the Netmaker server component. The codebase contains a static cryptographic key that can be leveraged to authenticate and execute administrative commands remotely. Exploitation requires knowledge of the target server's address and a valid administrator username. While the CVSS vector indicates high privileges are required, the nature of hard-coded credentials often allows for privilege escalation or bypass. The issue is fixed in versions 0.8.5, 0.9.4, and 0.10.0.

Affected products

• Gravitl Netmaker < 0.8.5, >= 0.9.0, < 0.9.4

Timeline

• 2022-02-18: disclosed
• 2022-02-18: patched
• 2022-02-22: advisory

References

• https://api.github.com/users/JamieSlome
• https://github.com/JamieSlome
• https://api.github.com/users/JamieSlome/gists%7B/gist_id%7D
• https://api.github.com/users/JamieSlome/repos
• https://avatars.githubusercontent.com/u/55323451?v=4
• https://api.github.com/users/JamieSlome/events%7B/privacy%7D