CVE-2022-0664 (published 2022-02-18T14:15Z)

Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.

Severity: HIGH
CVSS v2 base score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-321
cwe_name: Use of Hard-coded Cryptographic Key
description: The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
extended_description: 
             
             
			 
         
         

Fix information:
repo_url: https://github.com/gravitl/netmaker
commit_details: repo_url: https://github.com/gravitl/netmaker
author: 0xdcarns
author_date: 2022-02-15 21:50:47-05:00
msg: hotfix 2
repository: repo_url: https://github.com/gravitl/netmaker
repo_name: gravitl/netmaker
description: Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
repo_language: Go
owner: gravitl
file_changes: filename: jwts.go
change_type: ModificationType.MODIFY
diff: @@ -17,7 +17,11 @@ var jwtSecretKey []byte
 func SetJWTSecret() {
 	currentSecret, jwtErr := FetchJWTSecret()
 	if jwtErr != nil {
-		jwtSecretKey = []byte(RandomString(64)) // 512 bit random password
+		newValue, err := GenerateCryptoString(64)
+		if err != nil {
+			logger.FatalLog("something went wrong when generating JWT signature")
+		}
+		jwtSecretKey = []byte(newValue) // 512 bit random password
 		if err := StoreJWTSecret(string(jwtSecretKey)); err != nil {
 			logger.FatalLog("something went wrong when configuring JWT authentication")
 		}

programming_language: Go
filename: util.go
change_type: ModificationType.MODIFY
diff: @@ -2,9 +2,11 @@
 package logic
 
 import (
+	crand "crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"math/big"
 	"math/rand"
 	"net"
 	"os"
@@ -85,29 +87,20 @@ func SetNetworkNodesLastModified(networkName string) error {
 	return nil
 }
 
-// // GetNode - fetches a node from database
-// func GetNode(macaddress string, network string) (models.Node, error) {
-// 	var node models.Node
-
-// 	key, err := GetRecordKey(macaddress, network)
-// 	if err != nil {
-// 		return node, err
-// 	}
-// 	data, err := database.FetchRecord(database.NODES_TABLE_NAME, key)
-// 	if err != nil {
-// 		if data == "" {
-// 			data, _ = database.FetchRecord(database.DELETED_NODES_TABLE_NAME, key)
-// 			err = json.Unmarshal([]byte(data), &node)
-// 		}
-// 		return node, err
-// 	}
-// 	if err = json.Unmarshal([]byte(data), &node); err != nil {
-// 		return node, err
-// 	}
-// 	SetNodeDefaults(&node)
+// GenerateCryptoString - generates random string of n length
+func GenerateCryptoString(n int) (string, error) {
+	const chars = "123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-"
+	ret := make([]byte, n)
+	for i := range ret {
+		num, err := crand.Int(crand.Reader, big.NewInt(int64(len(chars))))
+		if err != nil {
+			return "", err
+		}
+		ret[i] = chars[num.Int64()]
+	}
 
-// 	return node, err
-// }
+	return string(ret), nil
+}
 
 // DeleteNodeByID - deletes a node from database or moves into delete nodes table
 func DeleteNodeByID(node *models.Node, exterminate bool) error {

programming_language: Go