GHSA-826j-8wp2-4x6q

Suggest an improvement
Source
https://github.com/advisories/GHSA-826j-8wp2-4x6q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-826j-8wp2-4x6q/GHSA-826j-8wp2-4x6q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-826j-8wp2-4x6q
Aliases
Published
2023-08-25T18:42:53Z
Modified
2023-11-08T04:12:33.559326Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User
Details

Impact

A Mass assignment vulnerability was found allowing a non-admin user to escalate privileges to admin user.

Patches

Issue is patched in 0.17.1, and fixed in 0.18.6+.

If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch them to the patched users

If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.

Workarounds

If using 0.17.1, can just pull the latest docker image of backend and restart server.

References

Credit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery

References

Affected packages

Go / github.com/gravitl/netmaker

Package

Name
github.com/gravitl/netmaker
View open source insights on deps.dev
Purl
pkg:golang/github.com/gravitl/netmaker

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.17.1

Go / github.com/gravitl/netmaker

Package

Name
github.com/gravitl/netmaker
View open source insights on deps.dev
Purl
pkg:golang/github.com/gravitl/netmaker

Affected ranges

Type
SEMVER
Events
Introduced
0.18.0
Fixed
0.18.6