cve/2019/CVE-2019-16097.md

CVE-2019-16097

Description

core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.

POC

Reference

• https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/

Github

• https://github.com/0day404/vulnerability-poc
• https://github.com/0xT11/CVE-POC
• https://github.com/20142995/Goby
• https://github.com/20142995/pocsuite
• https://github.com/20142995/sectool
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/ArrestX/--POC
• https://github.com/Awrrays/FrameVul
• https://github.com/Elsfa7-110/kenzer-templates
• https://github.com/HimmelAward/Goby_POC
• https://github.com/KayCHENvip/vulnerability-poc
• https://github.com/Miraitowa70/POC-Notes
• https://github.com/SexyBeast233/SecBooks
• https://github.com/TeraSecTeam/ary
• https://github.com/Threekiii/Awesome-POC
• https://github.com/Z0fhack/Goby_POC
• https://github.com/alphaSeclab/sec-daily-2019
• https://github.com/apachecn-archive/Middleware-Vulnerability-detection
• https://github.com/d4n-sec/d4n-sec.github.io
• https://github.com/dacade/cve-2019-16097
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/evilAdan0s/CVE-2019-16097
• https://github.com/hectorgie/PoC-in-GitHub
• https://github.com/hktalent/bug-bounty
• https://github.com/huimzjty/vulwiki
• https://github.com/ianxtianxt/CVE-2019-16097
• https://github.com/lovechinacoco/https-github.com-mai-lang-chai-Middleware-Vulnerability-detection
• https://github.com/luckybool1020/CVE-2019-16097
• https://github.com/pen4uin/awesome-vulnerability-research
• https://github.com/pen4uin/vulnerability-research
• https://github.com/pen4uin/vulnerability-research-list
• https://github.com/rockmelodies/CVE-2019-16097-batch
• https://github.com/tdtc7/qps
• https://github.com/theLSA/harbor-give-me-admin