CVE-2019-16097 PoC — Harbor 权限许可和访问控制问题漏洞

Source

https://github.com/evilAdan0s/CVE-2019-16097

Associated Vulnerability

Title: Harbor 权限许可和访问控制问题漏洞 (CVE-2019-16097)
Description:core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.

Description

CVE-2019-16097 PoC

Readme

# CVE-2019-16097
**本程序只供安全研究使用，请勿用作非法！**
## 漏洞危害
可导致攻击者创建管理员账户，从而上传恶意镜像，导致使用该仓库的客户端被感染
## 漏洞组件
Harbor
## 影响版本
1.7.0-1.8.2
## 修复建议
尽快升级至1.7.6或1.8.3

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →