CVE-2023-32079 Netmaker Privilige Escalation Vulnerability

What is CVE-2023-32079?

CVE-2023-32079 is a high-severity vulnerability in gravitl netmaker, published on 24 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.

Weakness: CWE-915

Which versions are affected by CVE-2023-32079?

5 open source packages ship an affected version, including github.com/gravitl/netmaker. It affects 1 product.

Products include Netmaker Netmaker.

How do I fix CVE-2023-32079?

Upgrade github.com/gravitl/netmaker to a fixed version for your release line: 0.17.1 or 0.18.6.

Is CVE-2023-32079 being exploited?

There is no known exploitation of CVE-2023-32079 in the wild and no public exploit code.

Other vulnerabilities in gravitl netmaker

• CVE-2022-36110 Netmaker vulnerable to Insufficient Granularity of Access Control High 8.8
• CVE-2022-0664 Use of Hard-coded Cryptographic Key in gravitl/netmaker High 8.8
• CVE-2026-29771 Netmaker: Denial of Service via Server Shutdown Endpoint High 8.7
• CVE-2026-38651 Netmaker does not verify JWT signatures for host tokens High 8.2
• CVE-2023-32077 Netmaker has Hardcoded DNS Secret Key High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-826j-8wp2-4x6q, GO-2023-2025.