PT-2022-20881 · Harbor · Harbor

Daniel Abeles + 1 · Published 2022-09-16 · Updated 2024-11-20 · CVE-2022-31669

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Harbor versions prior to 2.5.2

Description The issue arises from Harbor's failure to validate user permissions when updating tag immutability policies. This can be exploited by sending a request to update a tag immutability policy with an id belonging to a project that the currently authenticated user doesn’t have access to, allowing the attacker to modify tag immutability policies configured in other projects. The API endpoint PUT /projects/{project name or id}/immutabletagrules/{immutable rule id} is involved in this issue.

Recommendations For Harbor versions prior to 2.5.2, upgrade to Harbor v2.5.2 or later as soon as possible to fix the issue. As a temporary workaround, consider restricting access to the PUT /projects/{project name or id}/immutabletagrules/{immutable rule id} API endpoint to minimize the risk of exploitation.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BIT-HARBOR-2022-31669

CVE-2022-31669

GHSA-8C6P-V837-77F6

Affected Products

Harbor

References · 10

• https://github.com/goharbor/harbor/security/advisories/GHSA-8c6p-v837-77f6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8c6p-v837-77f6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31669 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31669 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-harbor-2022-31669 · Vendor Advisory
• https://github.com/goharbor/harbor · Note
• https://t.me/cvenotify/101662 · Telegram Post
• https://t.me/cvenotify/102137 · Telegram Post
• https://t.me/cvedetector/10941 · Telegram Post
• https://twitter.com/CVEnew/status/1857064988701077655 · Twitter Post