Critical Bug In Harbor Container Registry Gives Admin Access

guest · Sep 19, 2019

Critical Bug In Harbor Container Registry Gives Admin Access
September 19, 2019
https://www.bleepingcomputer.com/ne...harbor-container-registry-gives-admin-access/

Attackers can exploit a critical security vulnerability in Harbor cloud native registry for container images to obtain admin privileges on a vulnerable hosting system.
Harbor is open source and can integrate with Docker Hub and various image registries like Docker Registry and Google Container Registry, to add security, identity, and management features.
Create admin users
Palo Alto Networks' Unit 42 researcher Aviv Sasson discovered a critical vulnerability that could be exploited to take control of Harbor registries with the default configuration. Versions 1.7.0 through 1.8.2 are affected.

The researcher discovered that it is possible to send a POST request to "/api/users" with a payload containing user details and also add the 'HasAdminRole' parameter.

"If we send the same request with “had_admin_role” = “True”, then the user that will be created will be an admin. It’s as simple as that," Sasson explains.
Click to expand...

Palo Alto: Critical Vulnerability in Harbor Enables Privilege Escalation from Zero to Admin (CVE-2019-16097)

guest · Sep 26, 2019

VMware Patches Critical Harbor Vulnerability
September 26, 2019
https://www.securityweek.com/vmware-patches-critical-harbor-vulnerability

Tracked as CVE-2019-16097, the issue, a remote escalation of privilege, could result in attackers completely compromising vulnerable Harbor deployments.

In its advisory, VMware explains that the security flaw resides in the POST /api/users API of Harbor.

“Successful exploitation of this issue may lead to a complete compromise of the Harbor deployment,” VMware explains.
VMware has released patches to address the vulnerability in VMware Harbor Container Registry for PCF (versions 1.8.3 and 1.7.6), but has yet to address it in VMware Cloud Foundation (which is affected only if the optional 'Harbor Registry' component has been deployed).
Click to expand...

Log in or Sign up

Critical Bug In Harbor Container Registry Gives Admin Access

guest Guest

guest Guest

Log in or Sign up

Critical Bug In Harbor Container Registry Gives Admin Access

guest Guest

guest Guest

Useful Searches