Netmaker vulnerable to Insufficient Granularity of Access Control
GHSA-ggf6-638m-vqmg · CVE-2022-36110 · GO-2022-0986
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
Improper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.
In addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.
Patches
This problem has been patched in v0.15.1. To apply:
- docker-compose down
- docker pull gravitl/netmaker:v0.15.1
- docker-compose up -d
For more information
If you have any questions or comments about this advisory:
Email us at info@netmaker.io
This vulnerability was brought to our attention by @tweidinger
Ready to move
Start Securing
Free, no credit card | First findings in minutes