| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/gravitl/netmaker | < 1.5.0 | 1.5.0 |
| netmaker | < 1.5.0 | 1.5.0 |
Netmaker by Gravitl is an open-source WireGuard-based networking platform for creating and managing virtual overlay networks. The VerifyHostToken function in logic/jwts.go does not validate the JWT signature when verifying host tokens. After calling jwt.ParseWithClaims, the function only checks whether the returned token object is non-nil. It does not check token.Valid or the returned error. An attacker can forge a JWT signed with any key, set the claims to any host ID, and pull that host's full configuration including bcrypt-hashed passwords, MQTT credentials, and WireGuard peer data. The issue was patched in v1.5.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free