GitHub Advisoryadvisory · Go

GHSA-826j-8wp2-4x6q Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User

HIGH Published 2023-08-25 Modified 2023-08-25 Official page ↗
Aliases
CVE-2023-32079
Ecosystem
Go
Packages
github.com/gravitl/netmaker
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-915
Reviewed
2023-08-25

Affected packages

• Go github.com/gravitl/netmaker: < 0.17.1 → fixed in 0.17.1 • Go github.com/gravitl/netmaker: >= 0.18.0, < 0.18.6 → fixed in 0.18.6

Description

Impact A Mass assignment vulnerability was found allowing a non-admin user to escalate privileges to admin user. Patches Issue is patched in 0.17.1, and fixed in 0.18.6+. If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch them to the patched users If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. Workarounds If using 0.17.1, can just pull the latest docker image of backend and restart server. References Credit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery

Related

Alias · CVE (1)

  • CVE-2023-32079 Netmaker makes networks with WireGuard. vulnerability

Weakness · CWE (1)

  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References