PT-2023-17692 · Harbor · Harbor
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Harbor versions 2.6.x and earlier
Harbor versions 2.7.2 and earlier
Harbor versions 2.8.2 and earlier
Harbor versions 1.10.17 and earlier
Description
A timing condition in Harbor allows an attacker with network access to create jobs, stop job tasks, and retrieve job task information. The vulnerability occurs due to the comparison of secrets in the authenticator type being prone to timing attacks. The jobservice exposes several APIs, including "POST /api/v1/jobs" to create a job task, "GET /api/v1/jobs/{job id}" to get job task information, and "POST /api/v1/jobs/{job id}" to stop a job task. If an attacker obtains the secrets, it is possible to retrieve job information, create a job, or stop a job task.
Recommendations
For Harbor versions 2.6.x and earlier, update to Harbor 2.8.3 or later.
For Harbor versions 2.7.2 and earlier, update to Harbor 2.7.3 or later.
For Harbor versions 2.8.2 and earlier, update to Harbor 2.8.3 or later.
For Harbor versions 1.10.17 and earlier, update to Harbor 1.10.18 or later.
As a temporary workaround, consider blocking any inbound traffic from the external network to the jobservice container to reduce the risk.
Exploit
Fix
DoS
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Harbor