VMware this week released patches to address a critical vulnerability in Harbor, which was found to impact VMware Cloud Foundation and VMware Harbor Container Registry for PCF.
Harbor is an open source registry project for storing, signing and scanning container images for vulnerabilities. It integrates with Docker Hub, Docker Registry, Google Container Registry, and more, and allows users to easily download, upload, and scan images.
Tracked as CVE-2019-16097, the issue, a remote escalation of privilege, could result in attackers completely compromising vulnerable Harbor deployments.
Last week, Palo Alto Networks revealed that it had found over 1,300 Harbor registries exposed to the Internet with default settings, meaning that all were impacted by the vulnerability.
By exploiting the bug, attackers could download private projects, delete images in the registry, or replace them with poisoned ones.
In its advisory, VMware explains that the security flaw resides in the POST /api/users API of Harbor.
With a CVSSv3 base score of 9.8 and rated Critical, the vulnerability could allow a malicious actor with network access to the Harbor POST /api/users API to self-register a new administrative account.
“Successful exploitation of this issue may lead to a complete compromise of the Harbor deployment,” VMware explains.
VMware has released patches to address the vulnerability in VMware Harbor Container Registry for PCF (versions 1.8.3 and 1.7.6), but has yet to address it in VMware Cloud Foundation (which is affected only if the optional ‘Harbor Registry’ component has been deployed).
A workaround for this vulnerability also exists: users can disable self-registration in Harbor.
Related: Critical Vulnerability Exposes Harbor Registries to Attacks
Related: VMWare to Acquire Endpoint Security Firm Carbon Black
Related: VMware Unveils Security Enhancements in Virtual Cloud Network Offering
More from Ionut Arghire
- Vulnerabilities in OpenEMR Healthcare Software Expose Patient Data
- Russia-Linked APT29 Uses New Malware in Embassy Attacks
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Microsoft Urges Customers to Patch Exchange Servers
- Iranian APT Leaks Data From Saudi Arabia Government Under New Persona
- 820k Impacted by Data Breach at Zacks Investment Research
- US Government Agencies Warn of Malicious Use of Remote Management Software
Latest News
- Vulnerabilities in OpenEMR Healthcare Software Expose Patient Data
- Russia-Linked APT29 Uses New Malware in Embassy Attacks
- Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability
- The Effect of Cybersecurity Layoffs on Cybersecurity Recruitment
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- Microsoft Urges Customers to Patch Exchange Servers
