CVE-2023-20902: Timing attack risk in Harbor
A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.
Other sources
In the Harbor jobservice container, the comparison of secrets in the authenticator type is prone to timing attacks. The vulnerability occurs due to the following code: https://github.com/goharbor/harbor/blob/aaea068cceb4063ab89313d9785f2b40f35b0d63/src/jobservice/api/authenticator.go#L69-L69 To avoid this issue, constant time comparison should be used. subtle.ConstantTimeCompare([]byte(expectedSecret), []byte(secret)) == 0
Impact This attack might be possible theoretically, but no workable proof of concept is available, and access complexity is set at High. The jobservice exposes these APIs Create a job task --- POST /api/v1/jobs Get job task information --- GET /api/v1/jobs/{jobid} Stop job task --- POST /api/v1/jobs/{jobid} Get job log task --- GET /api/v1/jobs/{jobid}/log Get job execution --- GET /api/v1/jobs/{jobid}/executions Get job stats --- GET /api/v1/stats Get job service configuration --- GET /api/v1/config It is used to create jobs/stop job tasks and retrieve job task information. If an attacker obtains the secrets, it is possible to retrieve the job information, create a job, or stop a job task.
The following versions of Harbor are involved: <=Harbor 2.8.2, <=Harbor 2.7.2, <= Harbor 2.6.x, <=Harbor 1.10.17
Patches Harbor 2.8.3, Harbor 2.7.3, Harbor 1.10.18
Workarounds Because the jobservice only exposes HTTP service to harbor-core containers, blocking any inbound traffic from the external network to the jobservice container can reduce the risk.
Credits Thanks to Porcupiney Hairs for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-20902.
What is the severity of CVE-2023-20902?
The severity of CVE-2023-20902 is not specified.
How does the vulnerability occur?
The vulnerability occurs in the Harbor jobservice container due to a comparison of secrets in the authenticator type, which is prone to timing attacks.
How can I fix CVE-2023-20902?
To fix CVE-2023-20902, it is recommended to update to the following versions: 2.8.3, 2.7.3, or 1.10.18 of the Harbor package.
Where can I find more information about CVE-2023-20902?
More information about CVE-2023-20902 can be found in the GitHub security advisory: [https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf](https://github.com/goharbor/harbor/security/advisories/GHSA-mq6f-5xh5-hgcf)