CVE-2022-31670: Harbor Tag Retention Policy Unauthorized Modification Vulnerability
Summary
CVE-2022-31670: Harbor fails to validate the user permissions when updating tag retention policies. Affects harbor across 3 version ranges.
>= 1.0.0, < 1.10.13
>= 2.0.0, < 2.4.3
>= 2.5.0, < 2.5.2
Fixed in 1.10.13, 2.4.3 or 2.5.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-31670 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Harbor is an open-source cloud-native registry that stores, signs, and scans content. It provides a robust solution for managing container images and Helm charts, enabling organizations to maintain control over their software supply chain. However, it has been identified that Harbor has a vulnerability related to user permissions when updating tag retention policies, which could lead to unauthorized modifications.
Vulnerability Detail
The vulnerability arises from Harbor's failure to properly validate user permissions when a request is made to update tag retention policies. An attacker can exploit this flaw by sending a request with a tag retention policy ID that belongs to a project the attacker does not have access to. This could allow the attacker to modify retention policies in other projects, potentially leading to unauthorized access to sensitive data or disruption of service. The vulnerability affects multiple versions of Harbor, including those prior to 1.10.13, 2.4.3, and 2.5.2.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.10.131.10.13 -
>= 2.0.0, < 2.4.32.4.3 -
>= 2.5.0, < 2.5.22.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, restrict access to the Harbor registry to only trusted users and limit the ability to modify tag retention policies until the patch can be applied.
Conclusion
CVE-2022-31670 represents a significant security risk for users of Harbor, emphasizing the importance of maintaining up-to-date software and implementing proper access controls. By following the recommended steps to update and secure your Harbor installation, you can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for harbor →
FAQ
CVE-2022-31670 is a vulnerability in Harbor that allows unauthorized modification of tag retention policies due to insufficient user permission validation.
Versions of Harbor prior to 1.10.13, 2.4.3, and 2.5.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software by checking your manifest file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow an attacker to modify tag retention policies in projects they do not have access to, potentially leading to unauthorized data exposure or service disruptions.
If immediate updates are not possible, implement strict access controls and monitor user activities closely until the vulnerability can be patched.
References
Related vulnerabilities
Recent vulnerabilities recorded for harbor.
