Synopsis
Tenable Research has discovered a User Enumeration flaw in Harbor. We have confirmed the existence of the issue in versions 1.9.0 and 1.8.3, 1.8.4-rc1 (pre-release), and 1.9.1-rc1 (pre-release). We have given the issue a CVSSv2 vector of [AV:N/AC:L/Au:S/C:P/I:N/A:N].
The issue we have discovered is present in the "/users" api endpoint. According to documentation, this endpoint is supposed to be restricted to administrators. We have discovered that this restriction is able to be bypassed and information can be obtained via the "search" functionality.
The issue details are as follows:
Non-administrator users (such as those created via self-registration) can list all usernames and user IDs by sending a GET request to /api/users/search with no parameters, as follows:
curl -X GET "http://<host>/api/users/search" -H "accept: application/json" --user <user>:<password>
Using the email filter allows a non-administrator user to confirm the email address associated with a username, as follows:
curl -X GET "http://<host>/api/users/[email protected]" -H "accept: application/json" --user <user>:<password>
This filter may also be used to determine information about a user's email, as all users matching any part of the email parameter will be returned:
curl -X GET "http://<host>/api/users/[email protected]" -H "accept: application/json" --user <user>:<password>
will return all users who signed up with an "@test.com" email address.
In Harbor version 1.9.1-rc1 (pre-release), the email filter in "/api/users/search" has been removed and the username filter is mandatory, preventing the above listing of usernames and user IDs. These can be quickly enumerated as the required username filter will match any username that contains the filter:
curl -X GET "http://<host>/api/users/search?username=o" -H "accept: application/json" --user <user>:<password>
will return all usernames containing the letter "o". A complete list of usernames and user IDs can be obtained by inputting a single character at a time.
Solution
Apply vendor-supplied patch.Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team