CVE-2023-32077 (published 2023-08-24T22:15Z)

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-798
cwe_name: Use of Hard-coded Credentials
description: The product contains hard-coded credentials, such as a password or cryptographic key.
extended_description: 
		   There are two main variations:
		   
			 Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
			 Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
		   
         
         

Fix information:
repo_url: https://github.com/gravitl/netmaker
commit_details: repo_url: https://github.com/gravitl/netmaker
author: 0xdcarns
author_date: 2023-04-03 14:17:14-04:00
msg: fixed hard coded dns key
repository: repo_url: https://github.com/gravitl/netmaker
repo_name: gravitl/netmaker
description: Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
repo_language: Go
owner: gravitl
file_changes: filename: security.go
change_type: ModificationType.MODIFY
diff: @@ -187,7 +187,7 @@ func authenticateDNSToken(tokenString string) bool {
 	if len(tokens) < 2 {
 		return false
 	}
-	return tokens[1] == servercfg.GetDNSKey()
+	return len(servercfg.GetDNSKey()) > 0 && tokens[1] == servercfg.GetDNSKey()
 }
 
 func ContinueIfUserMatch(next http.Handler) http.HandlerFunc {

programming_language: Go
filename: serverconf.go
change_type: ModificationType.MODIFY
diff: @@ -277,7 +277,7 @@ func GetMasterKey() string {
 
 // GetDNSKey - gets the configured dns key of server
 func GetDNSKey() string {
-	key := "secretkey"
+	key := ""
 	if os.Getenv("DNS_KEY") != "" {
 		key = os.Getenv("DNS_KEY")
 	} else if config.Config.Server.DNSKey != "" {

programming_language: Go
repo_url: https://github.com/gravitl/netmaker
commit_details: repo_url: https://github.com/gravitl/netmaker
author: dcarns
author_date: 2023-04-04 08:23:11-04:00
msg: Merge pull request #2170 from gravitl/GRA-1493/dns-key

GRA-1493: fixed hard coded dns key
repository: repo_url: https://github.com/gravitl/netmaker
repo_name: gravitl/netmaker
description: Netmaker makes networks with WireGuard. Netmaker automates fast, secure, and distributed virtual networks.
repo_language: Go
owner: gravitl