CVE-2022-36110: Netmaker Insufficient Granularity of Access Control
Summary
CVE-2022-36110: Netmaker vulnerable to Insufficient Granularity of Access Control. Affects github.com/gravitl/netmaker versions < 0.15.1. Fixed in 0.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netmaker is an open-source platform written in Go that provides networking and connectivity solutions. It allows users to create and manage networks, nodes, and connections. The vulnerability in Netmaker arises from improper authorization functions, which can result in non-privileged users running privileged API calls. Additionally, the response codes for function calls differ, potentially enabling non-users to brute force network names on the system.
Vulnerability Detail
The vulnerability in Netmaker allows users with non-admin privileges to execute admin-level functions via the API. This can lead to unauthorized access and potential misuse of the platform. Furthermore, the differing response codes can be exploited to determine network names through brute force. The impact of this vulnerability is significant, as it compromises the integrity and security of the Netmaker platform.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.15.1
This is the first release that contains the fix.
go get github.com/gravitl/netmaker@v0.15.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Netmaker platform is vulnerable to an insufficient granularity of access control, allowing non-privileged users to execute privileged API calls and potentially gain unauthorized access. It is crucial to update to version 0.15.1 to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
The vulnerability allows non-privileged users to execute privileged API calls and potentially gain unauthorized access to the Netmaker platform. It also enables non-users to determine network names through brute force.
The recommended mitigation is to update Netmaker to version 0.15.1, which includes the necessary patches to address the vulnerability.
There are no known exploits for this vulnerability at the moment. However, it is crucial to apply the patch promptly to prevent any potential misuse.
Yes, this vulnerability can be exploited remotely if the Netmaker API is accessible over the network. It is essential to update to the patched version to mitigate the risk.
This vulnerability was discovered by @tweidinger and reported to the Netmaker team.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
