cvelistv5 - cve-2022-23650

CVE-2022-23650 (GCVE-0-2022-23650)

Vulnerability from cvelistv5 – Published: 2022-02-18 22:00 – Updated: 2025-04-23 19:02

Summary

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.

Severity ?

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-321 - Use of Hard-coded Cryptographic Key

Assigner

GitHub_M

References

URL

Tags

	https://github.com/gravitl/netmaker/security/advi…	x_refsource_CONFIRM
	https://github.com/gravitl/netmaker/pull/781/comm…	x_refsource_MISC
	https://github.com/gravitl/netmaker/commit/3d4f44…	x_refsource_MISC
	https://github.com/gravitl/netmaker/commit/e9bce2…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gravitl	netmaker	Affected: < 0.8.5 Affected: >= 0.9.0, < 0.9.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:51:44.211Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-23650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T15:55:56.957444Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T19:02:25.121Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netmaker",
          "vendor": "gravitl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.8.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.9.0, \u003c 0.9.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-321",
              "description": "CWE-321: Use of Hard-coded Cryptographic Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-02-18T22:00:12.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
        }
      ],
      "source": {
        "advisory": "GHSA-86f3-hf24-76q4",
        "discovery": "UNKNOWN"
      },
      "title": "Use of Hard-coded Cryptographic Key in Netmaker",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-23650",
          "STATE": "PUBLIC",
          "TITLE": "Use of Hard-coded Cryptographic Key in Netmaker"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "netmaker",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 0.8.5"
                          },
                          {
                            "version_value": "\u003e= 0.9.0, \u003c 0.9.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "gravitl"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-321: Use of Hard-coded Cryptographic Key"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4",
              "refsource": "CONFIRM",
              "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
            },
            {
              "name": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87",
              "refsource": "MISC",
              "url": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
            },
            {
              "name": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee",
              "refsource": "MISC",
              "url": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
            },
            {
              "name": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080",
              "refsource": "MISC",
              "url": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-86f3-hf24-76q4",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-23650",
    "datePublished": "2022-02-18T22:00:12.000Z",
    "dateReserved": "2022-01-19T00:00:00.000Z",
    "dateUpdated": "2025-04-23T19:02:25.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"0.8.5\", \"matchCriteriaId\": \"4F28A807-C8DF-4096-BB3D-0BF59F58349B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"0.9.0\", \"versionEndExcluding\": \"0.9.4\", \"matchCriteriaId\": \"5657BA6A-3F11-4BB7-B187-EFBAF3ECEBD0\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.\"}, {\"lang\": \"es\", \"value\": \"Netmaker es una plataforma para crear y administrara redes virtuales superpuestas usando WireGuard. En versiones anteriores a 0.8.5, 0.9.4 y 010.0, se presenta clave criptogr\\u00e1fica embebida en el c\\u00f3digo base que puede ser explotada para ejecutar comandos de administrador en un servidor remoto si el explotador conoce la direcci\\u00f3n y el nombre de usuario del administrador. Esto afecta al componente del servidor (netmaker), y no a los clientes. Esto ha sido parcheado en Netmaker v0.8.5, v0.9.4 y v0.10.0. Actualmente no se presentan medidas de mitigaci\\u00f3n conocidas\"}]",
      "id": "CVE-2022-23650",
      "lastModified": "2024-11-21T06:49:01.237",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:C/I:C/A:C\", \"baseScore\": 9.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2022-02-18T22:15:13.283",
      "references": "[{\"url\": \"https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-321\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-23650\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-02-18T22:15:13.283\",\"lastModified\":\"2024-11-21T06:49:01.237\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.\"},{\"lang\":\"es\",\"value\":\"Netmaker es una plataforma para crear y administrara redes virtuales superpuestas usando WireGuard. En versiones anteriores a 0.8.5, 0.9.4 y 010.0, se presenta clave criptogr\u00e1fica embebida en el c\u00f3digo base que puede ser explotada para ejecutar comandos de administrador en un servidor remoto si el explotador conoce la direcci\u00f3n y el nombre de usuario del administrador. Esto afecta al componente del servidor (netmaker), y no a los clientes. Esto ha sido parcheado en Netmaker v0.8.5, v0.9.4 y v0.10.0. Actualmente no se presentan medidas de mitigaci\u00f3n conocidas\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:C/I:C/A:C\",\"baseScore\":9.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-321\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.8.5\",\"matchCriteriaId\":\"4F28A807-C8DF-4096-BB3D-0BF59F58349B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"0.9.0\",\"versionEndExcluding\":\"0.9.4\",\"matchCriteriaId\":\"5657BA6A-3F11-4BB7-B187-EFBAF3ECEBD0\"}]}]}],\"references\":[{\"url\":\"https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"product\": \"netmaker\", \"vendor\": \"gravitl\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.8.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 0.9.0, \u003c 0.9.4\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-321\", \"description\": \"CWE-321: Use of Hard-coded Cryptographic Key\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2022-02-18T22:00:12.000Z\", \"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\"}, \"references\": [{\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080\"}], \"source\": {\"advisory\": \"GHSA-86f3-hf24-76q4\", \"discovery\": \"UNKNOWN\"}, \"title\": \"Use of Hard-coded Cryptographic Key in Netmaker\", \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"security-advisories@github.com\", \"ID\": \"CVE-2022-23650\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Use of Hard-coded Cryptographic Key in Netmaker\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"netmaker\", \"version\": {\"version_data\": [{\"version_value\": \"\u003c 0.8.5\"}, {\"version_value\": \"\u003e= 0.9.0, \u003c 0.9.4\"}]}}]}, \"vendor_name\": \"gravitl\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.\"}]}, \"impact\": {\"cvss\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-321: Use of Hard-coded Cryptographic Key\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4\", \"refsource\": \"CONFIRM\", \"url\": \"https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4\"}, {\"name\": \"https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87\", \"refsource\": \"MISC\", \"url\": \"https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87\"}, {\"name\": \"https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee\", \"refsource\": \"MISC\", \"url\": \"https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee\"}, {\"name\": \"https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080\", \"refsource\": \"MISC\", \"url\": \"https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080\"}]}, \"source\": {\"advisory\": \"GHSA-86f3-hf24-76q4\", \"discovery\": \"UNKNOWN\"}}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T03:51:44.211Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-23650\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T15:55:56.957444Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T15:55:58.587Z\"}}]}",
      "cveMetadata": "{\"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"assignerShortName\": \"GitHub_M\", \"cveId\": \"CVE-2022-23650\", \"datePublished\": \"2022-02-18T22:00:12.000Z\", \"dateReserved\": \"2022-01-19T00:00:00.000Z\", \"dateUpdated\": \"2025-04-23T19:02:25.121Z\", \"state\": \"PUBLISHED\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2022-23650

Vulnerability from fkie_nvd - Published: 2022-02-18 22:15 - Updated: 2024-11-21 06:49

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4	Third Party Advisory

Impacted products

	Vendor	Product	Version
	gravitl	netmaker	*
	gravitl	netmaker	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F28A807-C8DF-4096-BB3D-0BF59F58349B",
              "versionEndExcluding": "0.8.5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "5657BA6A-3F11-4BB7-B187-EFBAF3ECEBD0",
              "versionEndExcluding": "0.9.4",
              "versionStartIncluding": "0.9.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds."
    },
    {
      "lang": "es",
      "value": "Netmaker es una plataforma para crear y administrara redes virtuales superpuestas usando WireGuard. En versiones anteriores a 0.8.5, 0.9.4 y 010.0, se presenta clave criptogr\u00e1fica embebida en el c\u00f3digo base que puede ser explotada para ejecutar comandos de administrador en un servidor remoto si el explotador conoce la direcci\u00f3n y el nombre de usuario del administrador. Esto afecta al componente del servidor (netmaker), y no a los clientes. Esto ha sido parcheado en Netmaker v0.8.5, v0.9.4 y v0.10.0. Actualmente no se presentan medidas de mitigaci\u00f3n conocidas"
    }
  ],
  "id": "CVE-2022-23650",
  "lastModified": "2024-11-21T06:49:01.237",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-02-18T22:15:13.283",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-86F3-HF24-76Q4

Vulnerability from github – Published: 2022-02-22 19:40 – Updated: 2022-02-22 19:40

Summary

Use of Hard-coded Cryptographic Key in Netmaker

Details

Impact

There is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server, if you know the address and username of the admin. This effects the server (netmaker) component, and not clients.

Patches

This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. If you are running these versions, the fix is to perform the following:

docker-compose down
docker pull gravitl/netmaker:( version )
docker-compose up -d

Additional Information

If you are running any other version, you will need to upgrade to one of these three versions. If you have a special circumstance that requires running a different version, let us know and we may be able to build a custom patch.

For more information

If you have any questions or comments about this advisory: * Email us at info@gravitl.com

Severity ?

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitl/netmaker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitl/netmaker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.9.0"
            },
            {
              "fixed": "0.9.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-23650"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-321",
      "CWE-798"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-22T19:40:23Z",
    "nvd_published_at": "2022-02-18T22:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThere is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server, if you know the address and username of the admin. This effects the server (netmaker) component, and not clients.\n\n### Patches\nThis has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. If you are running these versions, the fix is to perform the following:\n\n1. docker-compose down\n2. docker pull gravitl/netmaker:( version )\n3. docker-compose up -d\n\n#### Additional Information\nIf you are running **any other version**, you will need to upgrade to one of these three versions. If you have a special circumstance that requires running a different version, let us know and we may be able to build a custom patch.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [info@gravitl.com](mailto:info@gravitl.com)\n",
  "id": "GHSA-86f3-hf24-76q4",
  "modified": "2022-02-22T19:40:23Z",
  "published": "2022-02-22T19:40:23Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23650"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gravitl/netmaker"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Use of Hard-coded Cryptographic Key in Netmaker"
}

GSD-2022-23650

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-23650

Aliases

CVE-2022-23650

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-23650",
    "description": "Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.",
    "id": "GSD-2022-23650"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-23650"
      ],
      "details": "Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.",
      "id": "GSD-2022-23650",
      "modified": "2023-12-13T01:19:34.898679Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-23650",
        "STATE": "PUBLIC",
        "TITLE": "Use of Hard-coded Cryptographic Key in Netmaker"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "netmaker",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 0.8.5"
                        },
                        {
                          "version_value": "\u003e= 0.9.0, \u003c 0.9.4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "gravitl"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-321: Use of Hard-coded Cryptographic Key"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4",
            "refsource": "CONFIRM",
            "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
          },
          {
            "name": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87",
            "refsource": "MISC",
            "url": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
          },
          {
            "name": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee",
            "refsource": "MISC",
            "url": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
          },
          {
            "name": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080",
            "refsource": "MISC",
            "url": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-86f3-hf24-76q4",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv0.8.5 || \u003e=v0.9.0 \u003cv0.9.4",
          "affected_versions": "All versions before 0.8.5, all versions starting from 0.9.0 before 0.9.4",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-02-26",
          "description": "Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.",
          "fixed_versions": [
            "v0.8.5",
            "v0.9.4"
          ],
          "identifier": "CVE-2022-23650",
          "identifiers": [
            "GHSA-86f3-hf24-76q4",
            "CVE-2022-23650"
          ],
          "not_impacted": "All versions starting from 0.8.5 before 0.9.0, all versions starting from 0.9.4",
          "package_slug": "go/github.com/gravitl/netmaker",
          "pubdate": "2022-02-22",
          "solution": "Upgrade to versions 0.8.5, 0.9.4 or above.",
          "title": "Use of Hard-coded Cryptographic Key in Netmaker",
          "urls": [
            "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-23650",
            "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87",
            "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee",
            "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080",
            "https://github.com/advisories/GHSA-86f3-hf24-76q4"
          ],
          "uuid": "0fffd532-af50-4431-b6fc-406eb0baf64a",
          "versions": [
            {
              "commit": {
                "sha": "79671cc8cdd735e76ea449baae2e1d6e32d1117b",
                "tags": [
                  "v0.8.5"
                ],
                "timestamp": "20211103215853"
              },
              "number": "v0.8.5"
            },
            {
              "commit": {
                "sha": "9e5872202b72dbc5e13cf1cc5c82c7ddd265c7e2",
                "tags": [
                  "v0.9.0"
                ],
                "timestamp": "20211117152351"
              },
              "number": "v0.9.0"
            },
            {
              "commit": {
                "sha": "44688fe32ce8340914ba5a81f999b794a33b6712",
                "tags": [
                  "v0.9.4"
                ],
                "timestamp": "20220116170236"
              },
              "number": "v0.9.4"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.8.5",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "0.9.4",
                "versionStartIncluding": "0.9.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-23650"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-798"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee"
            },
            {
              "name": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87"
            },
            {
              "name": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080"
            },
            {
              "name": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2022-03-08T16:30Z",
      "publishedDate": "2022-02-18T22:15Z"
    }
  }
}

CNVD-2022-13374

Vulnerability from cnvd - Published: 2022-02-23

Title

Gravitl Netmaker存在未明漏洞

Description

Gravitl Netmaker是美国Gravitl公司的一个使用WireGuard创建和管理快速、安全和动态的虚拟覆盖网络的平台。用于创建和控制自动化虚拟网络。 Gravitl Netmaker存在安全漏洞，攻击者可利用该漏洞在远程服务器上运行管理员命令。

Severity

高

Patch Name

Gravitl Netmaker存在未明漏洞的补丁

Patch Description

Gravitl Netmaker是美国Gravitl公司的一个使用WireGuard创建和管理快速、安全和动态的虚拟覆盖网络的平台。用于创建和控制自动化虚拟网络。 Gravitl Netmaker存在安全漏洞，攻击者可利用该漏洞在远程服务器上运行管理员命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4

Reference

https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee

Impacted products

Name
['Gravitl Netmaker <0.8.5', 'Gravitl Netmaker <0.9.4', 'Gravitl Netmaker <0.10.0']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-23650"
    }
  },
  "description": "Gravitl Netmaker\u662f\u7f8e\u56fdGravitl\u516c\u53f8\u7684\u4e00\u4e2a\u4f7f\u7528WireGuard\u521b\u5efa\u548c\u7ba1\u7406\u5feb\u901f\u3001\u5b89\u5168\u548c\u52a8\u6001\u7684\u865a\u62df\u8986\u76d6\u7f51\u7edc\u7684\u5e73\u53f0\u3002\u7528\u4e8e\u521b\u5efa\u548c\u63a7\u5236\u81ea\u52a8\u5316\u865a\u62df\u7f51\u7edc\u3002\n\nGravitl Netmaker\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u8fdc\u7a0b\u670d\u52a1\u5668\u4e0a\u8fd0\u884c\u7ba1\u7406\u5458\u547d\u4ee4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-13374",
  "openTime": "2022-02-23",
  "patchDescription": "Gravitl Netmaker\u662f\u7f8e\u56fdGravitl\u516c\u53f8\u7684\u4e00\u4e2a\u4f7f\u7528WireGuard\u521b\u5efa\u548c\u7ba1\u7406\u5feb\u901f\u3001\u5b89\u5168\u548c\u52a8\u6001\u7684\u865a\u62df\u8986\u76d6\u7f51\u7edc\u7684\u5e73\u53f0\u3002\u7528\u4e8e\u521b\u5efa\u548c\u63a7\u5236\u81ea\u52a8\u5316\u865a\u62df\u7f51\u7edc\u3002\r\n\r\nGravitl Netmaker\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u8fdc\u7a0b\u670d\u52a1\u5668\u4e0a\u8fd0\u884c\u7ba1\u7406\u5458\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Gravitl Netmaker\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Gravitl Netmaker \u003c0.8.5",
      "Gravitl Netmaker \u003c0.9.4",
      "Gravitl Netmaker \u003c0.10.0"
    ]
  },
  "referenceLink": "https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee",
  "serverity": "\u9ad8",
  "submitTime": "2022-02-22",
  "title": "Gravitl Netmaker\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-23650 (GCVE-0-2022-23650)

FKIE_CVE-2022-23650

GHSA-86F3-HF24-76Q4

Impact

Patches

Additional Information

For more information

GSD-2022-23650

CNVD-2022-13374

Tags

Sightings

Nomenclature