Is CVE-2023-32077 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-32077 being exploited in the wild.

How severe is CVE-2023-32077?

High severity, with a CVSS score of 7.5, published 25 August 2023.

Which products and versions are affected?

github.com/gravitl/netmaker (Go) SEMVER:introduced=0,fixed=0.17.1, SEMVER:introduced=0,fixed=0.17.1,introduced=0.18.0,fixed=0.18.6.

Is there a fix for CVE-2023-32077?

Yes. github.com/gravitl/netmaker (Go): upgrade to 0.17.1, 0.18.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-32077 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-32077?

Check whether you run github.com/gravitl/netmaker (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-32077: Netmaker hardcoded DNS secret key in API

CVE-2023-32077 · Severity: high · CVSS 7.5 · Published 2023-08-25

Netmaker, a platform for managing virtual networking and WireGuard-based VPNs, was found to contain a hardcoded secret key for its DNS component. This flaw allows unauthorized individuals to access and interact with the system's DNS API. An attacker could exploit this to view sensitive network configuration data, potentially compromising the privacy and security of the virtual network.

Technologies: github.com/gravitl/netmaker (Go). Vendors: Go.

Quick answers

Is CVE-2023-32077 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-32077 being exploited in the wild.
How severe is CVE-2023-32077?: High severity, with a CVSS score of 7.5, published 25 August 2023.
Which products and versions are affected?: github.com/gravitl/netmaker (Go) SEMVER:introduced=0,fixed=0.17.1, SEMVER:introduced=0,fixed=0.17.1,introduced=0.18.0,fixed=0.18.6.
Is there a fix for CVE-2023-32077?: Yes. github.com/gravitl/netmaker (Go): upgrade to 0.17.1, 0.18.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-32077 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-32077?: Check whether you run github.com/gravitl/netmaker (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/gravitl/netmaker (Go): upgrade to 0.17.1, 0.18.6 or later
```
go get github.com/gravitl/netmaker@v0.18.6
```

Technical details

A vulnerability exists in Netmaker due to the use of a hardcoded cryptographic secret key for DNS API authentication (CWE-321, CWE-798). This allows a remote, unauthenticated attacker to bypass intended security controls and interact directly with DNS API endpoints. By utilizing the static key, an attacker can gain unauthorized access to sensitive network information. The issue is resolved in versions 0.17.1 and 0.18.6+. Users on version 0.17.1 must pull the updated Docker image to apply the fix.

Affected products

gravitl Netmaker < 0.17.1, >= 0.18.0, < 0.18.6

Identifiers

CVE-2023-32077
GHSA-8x8h-hcq8-jwwx
GO-2023-2022

Timeline

2023-08-24: advisory: NVD publication date
2023-08-25: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.