Harbor validiert die Benutzerberechtigungen nicht, wenn Projektkonfigurationen in github.com/goharbor/harbor aktualisiert werden

The core of the vulnerability lies in Harbor’s insufficient validation of user permissions when updating project configurations. An attacker who can exploit this bypass can modify project settings, such as access control lists (ACLs) and replication policies. This could lead to unauthorized access to container images, the ability to push malicious images, and even complete control over the registry's functionality. The potential blast radius extends to any application or service relying on the compromised Harbor registry for container images, potentially impacting production environments and downstream systems. While no immediate precedent exists, a successful exploitation could mirror the impact of privilege escalation vulnerabilities in other container orchestration platforms.

Organizations heavily reliant on Harbor for container image storage and distribution are at significant risk. This includes DevOps teams, CI/CD pipelines, and any environment where containerized applications are deployed. Specifically, those using Harbor in multi-tenant environments or with complex RBAC configurations should prioritize patching.

• go / server:

journalctl -u harbor -f | grep -i 'permission denied'

• generic web:

curl -I <harbor_url>/api/projects/<project_name> | grep -i '403 forbidden'

1. 2024-08-06Disclosure

   disclosure

1. Reserviert2024-01-08
2. Veröffentlicht2024-08-06
3. Geändert2026-03-03
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-22278 is to upgrade Harbor to version 2.9.5+incompatible or later. If an immediate upgrade is not feasible due to compatibility concerns or ongoing maintenance windows, consider implementing stricter access controls and auditing project configuration changes. Regularly review Harbor's audit logs for any suspicious activity. While a direct WAF rule is unlikely to prevent this, implementing a proxy with robust authentication and authorization policies can add an extra layer of defense. After upgrading, confirm the fix by attempting to modify project configurations with a user account that should not have the necessary permissions; the operation should be denied.