Listen to this Post
How the CVE Works
The vulnerability in Harbor arises from an insecure ORM (Object-Relational Mapping) query parameter (q) in the `/api/v2.0/users` endpoint. Administrators can filter users by any column, including sensitive fields like password. By using the `password=~` filter, an attacker can perform a blind SQL-like injection to extract password hashes and salts character by character. This ORM leak allows unauthorized data exposure, enabling privilege escalation or credential theft. The flaw stems from improper input validation, exposing all endpoints using the `q` parameter to similar exploitation.
DailyCVE Form
Platform: Harbor
Version: Pre-2.6.0
Vulnerability: ORM Leak
Severity: Critical
Date: 2022-12-15
Prediction: Patch by 2023-02-28
What Undercode Say
curl -X GET 'https://<harbor>/api/v2.0/users?q=password=~' -H 'Authorization: Bearer <ADMIN_TOKEN>'
import requests
response = requests.get('https://<harbor>/api/v2.0/users?q=password=~a', headers={'Authorization': 'Bearer <ADMIN_TOKEN>'})
How Exploit
1. Acquire admin credentials.
2. Craft malicious `q=password=~` queries.
3. Exfiltrate hashes/salts via brute-force character matching.
Protection from this CVE
1. Upgrade to Harbor 2.6.0+.
2. Restrict `q` parameter to non-sensitive columns.
3. Implement rate-limiting on sensitive endpoints.
Impact
- Credential theft via hash/salt leakage.
- Privilege escalation to admin.
- Database compromise.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
