CVE-2022-23650: Use of Hard-coded Cryptographic Key in Netmaker
(updated )
There is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server, if you know the address and username of the admin. This effects the server (netmaker) component, and not clients.
References
- github.com/advisories/GHSA-86f3-hf24-76q4
- github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee
- github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080
- github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87
- github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4
- nvd.nist.gov/vuln/detail/CVE-2022-23650
Code Behaviors & Features
Detect and mitigate CVE-2022-23650 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →