{"id":"GHSA-8x8h-hcq8-jwwx","summary":"Netmaker has Hardcoded DNS Secret Key","details":"### Impact \nHardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints.\n\n### Patches\nIssue is patched in 0.17.1, and fixed in 0.18.6+. \n\nIf Users are using 0.17.1, they should run \"docker pull gravitl/netmaker:v0.17.1\" and \"docker-compose up -d\". This will switch them to the patched users\n\nIf users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.\n\n### Workarounds\nIf using 0.17.1, can just pull the latest docker image of backend and restart server.\n\n### References\nCredit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery","aliases":["CVE-2023-32077","GO-2023-2022"],"modified":"2026-05-19T16:15:15.523375286Z","published":"2023-08-25T18:38:18Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2023-08-25T18:38:18Z","nvd_published_at":"2023-08-24T22:15:08Z","cwe_ids":["CWE-321","CWE-798"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32077"},{"type":"WEB","url":"https://github.com/gravitl/netmaker/pull/2170"},{"type":"WEB","url":"https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51"},{"type":"WEB","url":"https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657"},{"type":"PACKAGE","url":"https://github.com/gravitl/netmaker"}],"affected":[{"package":{"name":"github.com/gravitl/netmaker","ecosystem":"Go","purl":"pkg:golang/github.com/gravitl/netmaker"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.17.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-8x8h-hcq8-jwwx/GHSA-8x8h-hcq8-jwwx.json"}},{"package":{"name":"github.com/gravitl/netmaker","ecosystem":"Go","purl":"pkg:golang/github.com/gravitl/netmaker"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0"},{"fixed":"0.18.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-8x8h-hcq8-jwwx/GHSA-8x8h-hcq8-jwwx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}