Netmaker up to 0.18.5 dynamically-determined object attributes

Summaryinfo

A vulnerability identified as very critical has been detected in Netmaker up to 0.18.5. This impacts an unknown function. Performing a manipulation results in dynamically-determined object attributes. This vulnerability is cataloged as CVE-2023-32079. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Netmaker up to 0.18.5. It has been classified as very critical. This affects some unknown functionality. The manipulation with an unknown input leads to a dynamically-determined object attributes vulnerability. CWE is classifying the issue as CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.

The weakness was shared 08/25/2023 as GHSA-826j-8wp2-4x6q. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2023-32079 since 05/01/2023. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/18/2026).

Upgrading to version 0.18.6 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Netmaker

Version

• 0.18.0
• 0.18.1
• 0.18.2
• 0.18.3
• 0.18.4
• 0.18.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion