CVE-2019-16097-batch

Disclaimer

Only for security research purposes. Do not use for illegal testing. You bear all consequences!!!

Batch vulnerability exploitation script

Add target addresses in batch to the url.txt file

http://1.1.1.1 http://2.2.2.2

Run this script with Python. The final verification results can be seen in result.txt.

Vulnerability Background

Recently, the image registry Harbor exposed an arbitrary administrator registration vulnerability. Attackers can construct a specific string in the request and directly create an administrator account without authorization, thereby taking over the Harbor image registry. Upon receiving the news, we quickly verified the vulnerability. The official announcement has been released, and the latest versions 1.7.6 and 1.8.3 have fixed this vulnerability. Users who use it are advised to upgrade to a secure version as soon as possible.

Vulnerability Description

Harbor is an enterprise-level Registry server for storing and distributing Docker images. There is a security vulnerability in the core/api/user.go file in Harbor versions 1.7.0 through 1.8.2. By adding key parameters to the request, attackers can exploit this vulnerability to create an administrator account and thus take over the Harbor image registry.