{"id":9924,"date":"2019-09-24T00:00:23","date_gmt":"2019-09-23T23:00:23","guid":{"rendered":"https:\/\/staging-site.42crunch.com\/?post_type=knowledge_series&p=9924"},"modified":"2022-09-24T16:12:18","modified_gmt":"2022-09-24T15:12:18","slug":"addressing-harbor-registry-vulnerability-with-42crunch","status":"publish","type":"post","link":"https:\/\/staging2022.42crunch.com\/addressing-harbor-registry-vulnerability-with-42crunch\/","title":{"rendered":"Addressing Harbor Registry Vulnerability with 42Crunch"},"content":{"rendered":"

Hot from the press! There is a mass assignment<\/a> vulnerability in the Harbor registry. Mass assignment is entry A6 on the OWASP API Security Top 10 list.<\/p>\n

A6 is described in the OWASP API Security Top 10 as:<\/p>\n

\n

An API endpoint is vulnerable if it automatically converts client parameters into internal object properties without considering the sensitivity and the exposure level of these properties. This could allow an attacker to update object properties that they should not have access to.<\/em><\/p>\n<\/blockquote>\n

As mentioned in the CVE report, this is exactly what happened. The API, written in Go, directly decodes the data sent to the API like this:<\/p>\n

if err := ua.DecodeJSONReq(&user); err != nil
\n<\/strong><\/p>\n

The User object contains the following:<\/p>\n

\"\"<\/p>\n

The key here is the HasAdminRole<\/strong> element: if a hacker can set this to true, it’s basically Game Over. Harbor is an open source project , we therefore have access to the source code<\/a>. The developers did a good job on the documentation here, which gives us the JSON property name to set (has_admin_role<\/strong>).<\/p>\n

How to prevent with the 42Crunch platform ?<\/h2>\n

You can use the 42Crunch platform to stop such attacks by defining an OpenAPI based allowlist: only what is in the defined schema will get accepted.<\/p>\n

In order to build the ultimate allowlist, you can use the Audit<\/strong><\/a> service to analyze your API definition and give you an audit score, which indicates the security quality of your OpenAPI file.<\/p>\n