User permission validation failure and disclosure of P2P preheat execution logs

Vulnerability

Overview

CVE-2022-31668 is an authorization bypass vulnerability in the Harbor container registry platform. The software fails to validate whether the currently authenticated user has the required permissions for the project when updating a p2p preheat policy via the PUT /projects/{project_name}/preheat/policies/{preheat_policy_name} API endpoint. By supplying a policy ID that belongs to a project the attacker does not have access to, the server processes the request without proper authorization checks [1][3][4].

Exploitation

Prerequisites

An attacker must have a valid authenticated session with the Harbor API. No additional privileges beyond standard user access are required to exploit this flaw. The attack can be performed remotely over the network by crafting a malicious update request targeting a p2p preheat policy in a different project [1][4].

Impact

Successful exploitation allows the attacker to modify p2p preheat policies that are configured in other projects. This can lead to unauthorized changes in how container images are pre-warmed across the registry, potentially affecting the availability and integrity of image distribution workflows within the Harbor instance [1][3][4].

Mitigation

Harbor has fixed this vulnerability in version 2.5.3 and later. Users are advised to upgrade as soon as possible. No workarounds are available for versions prior to the fix [4].