CVE-2023-32077 - CVE House

Back to Database

Status published High CVE-2023-32077

Netmaker has Hardcoded DNS Secret Key

7.5 CVSS

Vulnerability Description

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32077

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from gravitl

View All →

Netmaker Privilige Escalation Vulnerability

Netmaker IDOR Vulnerability Allows User to Update Other User's Password

Netmaker vulnerable to Insufficient Granularity of Access Control

Use of Hard-coded Cryptographic Key in Netmaker

Use of Hard-coded Cryptographic Key in gravitl/netmaker

Affected Vendor

gravitl

View all reports →

Affected Software

netmaker

Vulnerable Versions:

< 0.17.1, >= 0.18.0, < 0.18.6

Timeline

Official Publish: August 24th, 2023

Last Modified: October 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1552 Unsecured Credentials

Credential Access

T1040 Network Sniffing

Credential Access

T1537 Transfer Data to Cloud Account

Credential Access

T1078 Valid Accounts

T1041 Exfiltration Over C2 Channel