CVE-2023-32077: Netmaker hardcoded DNS secret key in API

Executive brief

Netmaker, a platform for managing virtual networking and WireGuard-based VPNs, was found to contain a hardcoded secret key for its DNS component. This flaw allows unauthorized individuals to access and interact with the system's DNS API. An attacker could exploit this to view sensitive network configuration data, potentially compromising the privacy and security of the virtual network.

Technical details

A vulnerability exists in Netmaker due to the use of a hardcoded cryptographic secret key for DNS API authentication (CWE-321, CWE-798). This allows a remote, unauthenticated attacker to bypass intended security controls and interact directly with DNS API endpoints. By utilizing the static key, an attacker can gain unauthorized access to sensitive network information. The issue is resolved in versions 0.17.1 and 0.18.6+. Users on version 0.17.1 must pull the updated Docker image to apply the fix.

Affected products

• gravitl Netmaker < 0.17.1, >= 0.18.0, < 0.18.6

Timeline

• 2023-08-24: advisory: NVD publication date
• 2023-08-25: disclosed: GitHub Advisory published

References

• https://api.github.com/users/rootxharsh
• https://github.com/rootxharsh
• https://api.github.com/users/rootxharsh/gists%7B/gist_id%7D
• https://api.github.com/users/rootxharsh/repos
• https://avatars.githubusercontent.com/u/21000421?v=4
• https://api.github.com/users/rootxharsh/events%7B/privacy%7D