CVE-2024-22244
📋 TL;DR
This CVE describes an open redirect vulnerability in Harbor container registry software. Attackers can craft malicious URLs that redirect Harbor users to external malicious sites when clicked. This affects all Harbor users running vulnerable versions.
💻 Affected Systems
- Harbor
📦 What is this software?
Harbor by Linuxfoundation
Harbor by Linuxfoundation
Harbor by Linuxfoundation
⚠️ Risk & Real-World Impact
Worst Case
Users could be redirected to phishing sites that steal credentials or deliver malware, potentially compromising their systems or organizational credentials.
Likely Case
Users are redirected to malicious sites that may attempt credential harvesting or deliver low-level malware.
If Mitigated
With proper user awareness training and browser security controls, users would recognize suspicious redirects and avoid interacting with malicious sites.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but no authentication to Harbor.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.8.5, v2.9.3, v2.10.1
Vendor Advisory: https://github.com/goharbor/harbor/security/advisories/GHSA-5757-v49g-f6r7
Restart Required: Yes
Instructions:
1. Backup your Harbor configuration and database. 2. Upgrade to patched version (v2.8.5, v2.9.3, or v2.10.1). 3. Restart Harbor services. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or proxy rules to filter redirect URLs containing external domains.
🧯 If You Can't Patch
- Implement network segmentation to restrict Harbor access to trusted users only.
- Deploy user awareness training about phishing risks and suspicious URLs.
🔍 How to Verify
Check if Vulnerable:
Check Harbor version via web UI admin panel or API endpoint /api/v2.0/systeminfo.Check Version:
curl -k https://<harbor-host>/api/v2.0/systeminfo | grep "harbor_version"Verify Fix Applied:
Verify version is v2.8.5, v2.9.3, or v2.10.1 or higher via /api/v2.0/systeminfo endpoint.📡 Detection & Monitoring
Log Indicators:
- HTTP 302 redirect responses to external domains in access logs
- Unusual redirect patterns in application logs
Network Indicators:
- HTTP traffic with redirect parameters pointing to unexpected domains
SIEM Query:
web_access_logs status_code=302 AND url CONTAINS "redirect=" AND NOT url CONTAINS "harbor-domain"