Description

Impact

Matt Hamilton from Soluble has discovered a limited Server-Side Request Forgery (SSRF) that allowed Harbor project owners to scan the TCP ports of hosts on the Harbor server's internal network.

The vulnerability was immediately fixed by the Harbor team.

Issue

The “Test Endpoint” API, part of the functionality for ensuring a project Webhook is accessible and functional, is vulnerable to a limited SSRF attack. A malicious user that is also a project administrator can use this API for internal port scanning.

Known Attack Vectors

Successful exploitation of this issue will lead to bad actors identifying open TCP ports on any network that is accessible by the Harbor core services

Patches

If your product uses the affected releases of Harbor, update to version 2.0.1 to patch this issue immediately.

https://github.com/goharbor/harbor/releases/tag/v2.0.1

Workarounds

Since only project administrators (the user that created the project) are allowed to test the webhook endpoints configured in Harbor, a Harbor system administrator can control who is a project admin. In addition, Harbor system administrators can enforce a setting where only an administrator is allowed to create new projects instead of the default Everyone. This further restricts who can be a project administrator in Harbor.

For more information

If you have any questions or comments about this advisory, contact [email protected]
View our security policy at https://github.com/goharbor/harbor/security/policy
https://nvd.nist.gov/vuln/detail/CVE-2020-13788
https://www.soluble.ai/blog/harbor-ssrf-cve-2020-13788

Basic information

Type: reviewed
Severity: low
Advisory on GitHub: Open advisory ↗
Repository advisory: Open repository advisory ↗
Source code: Not specified
Published (advisory): 2022-02-11 23:17:02 UTC
Updated: 2023-01-09 05:04:57 UTC
GitHub reviewed: 2021-05-24 19:08:11 UTC

Score	Percentile
0.20%	42.28%

CVSS Scores

Base score	Version	Severity	Vector
4.0	3.1	—	`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:H) Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:N) Data isn’t meaningfully altered or forged. Availability (A:N) Service keeps running; no real outage angle. Exploit maturity (E:P) There’s at least a proof-of-concept or demo code out there. Fix status (RL:O) Vendor shipped an official fix you’re meant to install. Report confidence (RC:C) Treat it as confirmed—the vulnerability and impact line up with evidence.

Identifiers

Type	Value
GHSA	GHSA-33p6-fx42-7rf5 ↗
CVE	CVE-2020-13788 ↗

CWEs

CWE id	Name
CWE-918	Server-Side Request Forgery (SSRF)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem	Package	Vulnerable range	First patched	Vulnerable functions
go	github.com/goharbor/harbor	>= 1.8.0, < 2.0.1	2.0.1	—

Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)