CVE-2022-31669: Harbor fails to validate the user permissions when updating tag immutability policies
Impact Harbor fails to validate the user permissions when updating tag immutability policies - API call:
PUT /projects/{projectnameorid}/immutabletagrules/{immutableruleid}
By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies configured in other projects.
Patches This and similar issues are fixed in Harbor v2.5.2 and later. Please upgrade as soon as possible.
Workarounds There are no workarounds available.
For more information If you have any questions or comments about this advisory: Open an issue in the Harbor GitHub repository
Credits Thanks to Gal Goldstein and Daniel Abeles from Oxeye Security for reporting this issue.
Other sources
Harbor fails to validate the user permissions when updating tag immutability policies.
By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modify tag immutability policies configured in other projects.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the impact of CVE-2022-31669?
CVE-2022-31669 allows unauthorized users to update tag immutability policies due to inadequate permission validation by Harbor.
Which versions of Harbor are affected by CVE-2022-31669?
CVE-2022-31669 affects Harbor versions 2.5.0 to 2.5.1, 2.0.0 to 2.4.2, and 1.0.0 to 1.10.12.
How can I remediate CVE-2022-31669?
To mitigate CVE-2022-31669, upgrade Harbor to version 2.5.2, 2.4.3, or 1.10.13 or later.
What does the CVE-2022-31669 vulnerability allow attackers to do?
Attackers exploiting CVE-2022-31669 can modify tag immutability settings without proper authorization.
Is CVE-2022-31669 an important vulnerability?
Yes, CVE-2022-31669 is important as it can lead to unauthorized changes in tag management within the Harbor container registry.