As elaborated in a blog post, the privilege escalation vulnerability CVE-2019-16097, allowed an attacker to gain admin access simply by sending a malicious request to the target machine.
Specifically, the attacker could register a new user whilst sending a POST request to “/api/users” that includes user details and HasAdminRole parameter. As stated in the blog post, doing so is quite simple.
We can send a request and add the parameter “The attacker could then sign-in with this new account to gain admin access. Consequently, the attacker could perform a variety of activities including registering new admin users, downloading and inspecting private projects, and replacing images with malware and crypto miners.has_admin_role”. If we send the same request withhas_admin_role = True, then the user that will be created will be an admin.
Following the discovery, Harbor released a fix for this flaw with versions 1.7.6 and 1.8.3. The patch includes a check for non-admin users to create admin accounts while registering.
Users must ensure updating to the latest versions to stay protected from any exploit. Whereas, to know a possible hacking attack, users can look for unrecognized admin users on their Harbor instance.
Let us know your thoughts in the comments.
