GHSA-4hgg-c4rr-6h7fHigh
Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys
🔗 CVE IDs covered (1)
📋 Description
A user assigned the platform-user role can retrieve WireGuard private keys of all wireguard configs in a network by calling GET /api/extclients/{network} or GET /api/nodes/{network}. While the Netmaker UI restricts visibility, the API endpoints return full records, including private keys, without filtering based on the requesting user's ownership.
Credits Artem Danilov (Positive Technologies)
🎯 Affected products1
- go/github.com/gravitl/netmaker:< 1.5.0