CVE-2024-22278: Harbor fails to validate the user permissions when updating project configurations
Impact Harbor fails to validate the maintainer role permissions when creating/updating/deleting project configurations - API call:
- PUT /projects/{projectnameorid}/metadatas/{metaname} - POST /projects/{projectnameorid}/metadatas/{metaname} - DELETE /projects/{projectnameorid}/metadatas/{metaname}
By sending a request to create/update/delete a metadata with an name that belongs to a project that the currently authenticated and granted to the maintainer role user doesn’t have access to, the attacker could modify configurations in the current project.
BTW: the maintainer role in Harbor was intended for individuals who closely support the project admin in maintaining the project but lack configuration management permissions. However, the maintainer role can utilize the metadata API to circumvent this limitation. It's important to note that any potential attacker must be authenticated and granted a specific project maintainer role to modify configurations, limiting their scope to only that project.
Patches Will be fixed in v2.9.5, v2.10.3 and v2.11.0
Workarounds There are no workarounds available.
Credit Thanks to Ravid Mazon(rmazon@paloaltonetworks.com), Jay Chen (jaychen@paloaltonetworks.com) Palo Alto Networks for reporting this issue.
Other sources
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22278?
CVE-2024-22278 is classified with a high severity due to improper validation of maintainer role permissions affecting project configurations.
How do I fix CVE-2024-22278?
To remediate CVE-2024-22278, upgrade your Harbor software to version 2.10.3 or later, or to version 2.9.5 if you are on an earlier release.
What versions of Harbor are affected by CVE-2024-22278?
Harbor versions 2.10.0 to 2.10.2 are affected, along with versions up to 2.9.5.
What type of vulnerability is CVE-2024-22278?
CVE-2024-22278 is an authorization vulnerability that allows unauthorized access to project configuration management.
Is CVE-2024-22278 exploitable remotely?
Yes, CVE-2024-22278 is potentially exploitable remotely since it involves API calls that can be triggered from external sources.