Headline
CVE-2022-36110: Insufficient Granularity of Access Control in Netmaker
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.
This vulnerability was brought to our attention by @tweidinger
Impact
Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.
In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.
Patches
This problem has been patched in v0.15.1. To apply:
- docker-compose down
- docker pull gravitl/netmaker:v0.15.1
- docker-compose up -d
For more information
If you have any questions or comments about this advisory:
Email us at [email protected]
Related news
### Impact Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API. In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system. ### Patches This problem has been patched in v0.15.1. To apply: 1. docker-compose down 2. docker pull gravitl/netmaker:v0.15.1 3. docker-compose up -d ### For more information If you have any questions or comments about this advisory: Email us at [[email protected]](mailto:[email protected]) This vulnerability was brought to our attention by @tweidinger