CVE-2022-31667: Harbor fails to validate the user permissions when updating a robot account
Impact Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to. API call:
PUT /robots/{robotid}
By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
Patches This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible.
Workarounds There are no workarounds available.
For more information If you have any questions or comments about this advisory: Open an issue in the Harbor GitHub repository
Credits Thanks to Gal Goldstein and Daniel Abeles from Oxeye Security for reporting this issue.
Other sources
Harbor fails to validate the user permissions when updating a robot account that belongs to a project that the authenticated user doesn’t have access to.
By sending a request that attempts to update a robot account, and specifying a robot account id and robot account name that belongs to a different project that the user doesn’t have access to, it was possible to revoke the robot account permissions.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31667?
CVE-2022-31667 is rated as a high severity vulnerability due to improper user permission validation.
How do I fix CVE-2022-31667?
To fix CVE-2022-31667, upgrade Harbor to version 2.5.2, 2.4.3, or 1.10.13 or later.
What types of systems are affected by CVE-2022-31667?
CVE-2022-31667 affects Harbor versions from 2.0.0 to 2.5.1, 1.0.0 to 1.10.12, and specific versions of Linuxfoundation Harbor include.
What is the nature of the vulnerability in CVE-2022-31667?
CVE-2022-31667 allows unauthorized users to update robot accounts in projects they don't have access to.
Are there any workarounds for CVE-2022-31667?
There are no specific workarounds for CVE-2022-31667; applying the recommended upgrades is necessary.