CVE-2024-22244: Harbor Open Redirect URL
First published: Sun Jun 02 2024(Updated: )
### Description Under OIDC authentication mode, there is a redirect_url parameter exposed in the URL which is used to redirect the current user to the defined location after the successful OIDC login, This redirect_url can be an ambiguous URL and can be used to embed a phishing URL. For example: if a user clicks the URL with a malicious redirect_url: ``` https://<harbor_hostnmae>/c/oidc/login?redirect_url=https://<redirect_domain> ``` It might redirect the current user without their knowledge to a malicious site, posing a potential risk. To avoid this issue, the redirect_url should be checked if it is a local path when reading it from the original request URL. ``` //src/core/controllers/oidc.go ... redirectURL := oc.Ctx.Request.URL.Query().Get("redirect_url") if !utils.IsLocalPath(redirectURL) { log.Errorf("invalid redirect url: %v", redirectURL) oc.SendBadRequestError(fmt.Errorf("cannot redirect to other site")) return } if err := oc.SetSession(redirectURLKey, redirectURL); err != nil { ... ``` ### Impact When Harbor is configured with OIDC authentication and users log in via a link outside the Harbor server, it might be vulnerable to an open redirect attack. This attack only involves the OIDC Harbor user, if the current Harbor instance is not configured with OIDC auth, the redirect_url doesn't exist and the Harbor instance is not vulnerable to the open redirect attack. The following versions of Harbor are involved: <=Harbor 2.8.4, <=Harbor 2.9.2, <= Harbor 2.10.0 ### Patches Harbor 2.8.5, Harbor 2.9.3, Harbor 2.10.1 ### Workarounds When the Harbor is configured with OIDC authentication, warn the user not to log into the Harbor through external links. ### References N/A ### Credit Thanks Arnaud Cordier (arnaud@cordier.work)
Credit: security@vmware.com security@vmware.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| go/github.com/goharbor/harbor | >=2.10.0<2.10.1 | 2.10.1 |
| go/github.com/goharbor/harbor | >=2.9.0<2.9.3 | 2.9.3 |
| go/github.com/goharbor/harbor | <2.8.5 | 2.8.5 |
| Harbor | >=2.8.0<2.8.5 | |
| Harbor | >=2.9.0<2.9.3 | |
| Harbor | =2.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-22244?
CVE-2024-22244 has been classified as a high severity vulnerability due to its potential to facilitate phishing attacks.
How do I fix CVE-2024-22244?
To mitigate CVE-2024-22244, upgrade to Harbor version 2.10.1, 2.9.3, or 2.8.5 or later.
What does CVE-2024-22244 affect?
CVE-2024-22244 affects multiple versions of Harbor, including versions prior to 2.10.1, 2.9.3, and up to 2.8.5.
Can CVE-2024-22244 be exploited in production environments?
Yes, CVE-2024-22244 can be exploited in production environments by redirecting users to malicious URLs.
What type of attack is facilitated by CVE-2024-22244?
CVE-2024-22244 facilitates phishing attacks by allowing the injection of ambiguous URLs in the redirect_url parameter.
- agent/weakness
- agent/first-publish-date
- agent/title
- agent/type
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5757-v49g-f6r7
- alias/CVE-2024-22244
- agent/software-canonical-lookup
- agent/references
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- package-manager/go
- vendor/linuxfoundation
- canonical/harbor
- version/harbor/2.8.0
- version/harbor/2.9.0
- version/harbor/2.10.0