Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1nZ2Y2LTYzOG0tdnFtZ84AAuz0

Netmaker vulnerable to Insufficient Granularity of Access Control

Impact

Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.

In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.

Patches

This problem has been patched in v0.15.1. To apply:

1. docker-compose down
2. docker pull gravitl/netmaker:v0.15.1
3. docker-compose up -d

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]
This vulnerability was brought to our attention by @tweidinger

Permalink: https://github.com/advisories/GHSA-ggf6-638m-vqmg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nZ2Y2LTYzOG0tdnFtZ84AAuz0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: 10 months ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-ggf6-638m-vqmg, CVE-2022-36110
References:

• https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg
• https://nvd.nist.gov/vuln/detail/CVE-2022-36110
• https://github.com/gravitl/netmaker/releases/tag/v0.15.1
• https://github.com/advisories/GHSA-ggf6-638m-vqmg

Repository: https://github.com/gravitl/netmaker
Blast Radius: 6.8

Affected Packages