Timing attack risk in Harbor

Vulnerability

Overview

CVE-2023-20902 is a vulnerability in Harbor, an open-source cloud-native container registry. A timing condition (a race condition) affects Harbor versions 2.6.x and below, 2.7.2 and below, 2.8.2 and below, and 1.10.17 and below [1][2]. This flaw allows an attacker with network access to create or stop job tasks, as well as retrieve job task information [2].

Exploitation

Prerequisites

An attacker must have network access to the Harbor instance, but no authentication or special privileges are explicitly required in the description [2]. The root cause is a timing condition, likely in the job service API authenticator or job task management, which can be exploited to perform unauthorized job operations [4].

Impact

Successful exploitation enables an attacker to create or stop job tasks and retrieve job task information, which could lead to disruption of normal operations, information disclosure about task details, or potential further abuse of the job service [2].

Mitigation

Patched versions include Harbor 2.7.3 and later releases in the 2.7 branch, as well as corresponding fixed versions for other branches [3]. Users are advised to upgrade to a patched version immediately. There is no mention of workarounds in the provided references.