Harbor Enables Privilege Escalation From Zero to admin

VMware Harbor Registry is for store and distribute container images, It is an enterprise class registry server. By submitting a malicious message to Harbor registries, attackers will gain control of them. Non-admin users can create admin accounts in Harbor 1.7.0 or 1.8.2 by using the POST /api/users API; this is allowed by core/api/user.go.

Impacted Products

• VMware Cloud Foundation
• VMware Harbor Container Registry for PCF How to determine if the product has been threatened:
• You are using database authentication.
• You’ve allowed self-registration.

Mitigation / Precaution

• If your product relies on Harbor, you must immediately update to 1.7.6/1.8.3.
• In your Harbor Container Registry, disable self-registration for consumers.
• Instead of using DB authentication, use a different identity provider (such as an LDAP store).

Written by

Nash N Sulthan

Cyber Security Lead Engineer

Nash is a seasoned Security Engineer who brings a multifaceted approach to safeguarding digital environments. Not only does he excel in implementing robust security measures, but he's also deeply involved in the research and development process, constantly innovating to stay ahead of cyber threats. Nash's commitment to security extends beyond the conventional, making him a valuable contributor to the evolving landscape of digital defense.