Harbor fails to validate the user permissions when updating a robot account

Vulnerability

Overview Harbor, the cloud-native container registry, fails to validate user permissions when updating a robot account that belongs to a project the authenticated user does not have access to [1][3]. The flaw resides in the API endpoint PUT /robots/{robot_id}. By specifying a robot_id and robot_name associated with a different project, an attacker can revoke that robot account's permissions even without proper project membership or rights [1][3].

Exploitation

Requirements An attacker must be authenticated to the Harbor instance. No special privileges or knowledge of the target project's credentials are needed beyond the ability to send a crafted API request [1][3]. The attacker only needs to know or guess the robot_id and the corresponding robot account name for a project they are not authorized to access [1][3].

Impact

A successful attack allows the attacker to revoke the permissions of a robot account belonging to any project in the Harbor instance [1][3]. This can disrupt automated CI/CD pipelines or any other processes that depend on that robot account for image push/pull operations, effectively causing a denial of service for the affected project's workflows.

Mitigation

Harbor has fixed this issue in version 2.5.2 and later [3]. Users should upgrade to the latest release immediately. No official workarounds are available [3]. The vulnerability was reported by Gal Goldstein and Daniel Abeles from Oxeye Security [3].