Description
Netmaker是Gravitl公司推出的开源网络管理平台，专为WireGuard VPN网络设计和管理而开发。该产品提供自动化网络配置、DNS管理、访问控制等功能，广泛应用于企业VPN网络部署和管理场景。Netmaker在0.17.1和0.18.6之前的版本中，/api/dns接口存在硬编码密钥未授权访问漏洞，攻击者可利用预设密钥访问DNS API端点获取网络配置信息。
Netmaker /api/dns 未授权访问漏洞（CVE-2023-32077）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://vulnso.com/vuln/netmaker-apidns-%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E6%BC%8F%E6%B4%9E%EF%BC%88cve-2023-32077%EF%BC%89
https://cve.imfht.com/analysis-public/CVE-2023-32077
https://nvd.nist.gov/vuln/detail/CVE-2023-32077
https://github.com/advisories/GHSA-8x8h-hcq8-jwwx
https://corgea.com/advisories/vulnerabilities/CVE-2023-32077
https://db.gcve.eu/vuln/gsd-2023-32077
https://pentest-tools.com/vulnerabilities-exploits/netmaker-hardcoded-dns-secret-key_25984
https://www.cybersecurity-help.cz/vdb/SB2023090530