Harbor fails to validate the user permissions when updating p2p preheat policies
Date: 2024-11
Affected: go/github.com/goharbor/harbor/src, go/github.com/goharbor/harbor, go/github.com/goharbor/harbor
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2022-31668
CWE: CWE-285
CVSS: 7.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L)

Harbor fails to validate the user permissions when updating p2p preheat policies. By sending a request to update a p2p preheat policy with an id that belongs to a project that the currently authenticated user doesn't have access to, the attacker could modify p2p preheat policies configured in other projects.


Mitigations:

Architectural layers (MAESTRO):