Harbor.io User Enumeration Vulnerability

Tenable Research has discovered a User Enumeration flaw in Harbor. We have confirmed the existence of the issue in versions 1.9.0 and 1.8.3, 1.8.4-rc1 (pre-release), and 1.9.1-rc1 (pre-release). We have given the issue a CVSSv2 vector of [AV:N/AC:L/Au:S/C:P/I:N/A:N].

The issue we have discovered is present in the "/users" api endpoint. According to documentation, this endpoint is supposed to be restricted to administrators. We have discovered that this restriction is able to be bypassed and information can be obtained via the "search" functionality.

The issue details are as follows:

Non-administrator users (such as those created via self-registration) can list all usernames and user IDs by sending a GET request to /api/users/search with no parameters, as follows:

curl -X GET "http://<host>/api/users/search" -H "accept: application/json" --user <user>:<password>

Using the email filter allows a non-administrator user to confirm the email address associated with a username, as follows:

curl -X GET "http://<host>/api/users/[email protected]" -H "accept: application/json" --user <user>:<password>

This filter may also be used to determine information about a user's email, as all users matching any part of the email parameter will be returned:

curl -X GET "http://<host>/api/users/[email protected]" -H "accept: application/json" --user <user>:<password>

will return all users who signed up with an "@test.com" email address.

In Harbor version 1.9.1-rc1 (pre-release), the email filter in "/api/users/search" has been removed and the username filter is mandatory, preventing the above listing of usernames and user IDs. These can be quickly enumerated as the required username filter will match any username that contains the filter:

curl -X GET "http://<host>/api/users/search?username=o" -H "accept: application/json" --user <user>:<password>

will return all usernames containing the letter "o". A complete list of usernames and user IDs can be obtained by inputting a single character at a time.