Identifying a BOLA Vulnerability in Harbor, a Cloud
Unit 42 found a BOLA flaw, CVE-2024-22278 (CVSS 6.4), letting Maintainers improperly alter Harbor project metadata; fixed in versions 2.9.5, 2.10.3, and 2.11.0.
Unit 42 researchers identified a broken object-level authorization flaw, CVE-2024-22278, in Harbor, a CNCF-graduated cloud-native container registry with 1.8 million downloads. The flaw (CVSS 6.4) lets users with the Maintainer role create, update, and delete project metadata, actions reserved for ProjectAdmin, risking data exposure, integrity compromise, and circumvention of vulnerability scanning. Harbor patched the issue in versions 2.9.5, 2.10.3, and 2.11.0. The finding came from Unit 42's automated BOLA detection tool built on generative AI.
- CVE-2024-22278 (CVSS 6.4) is a BOLA flaw in Harbor project metadata APIs
- Maintainer-role users could perform ProjectAdmin-only metadata changes
- Fixed in Harbor versions 2.9.5, 2.10.3, and 2.11.0
- Found using an automated GenAI-powered BOLA detection tool
- CVEs
- CVE-2024-22278
- Vendors
- Palo Alto NetworksCNCF
- Products
- Harbor
- Threat actors
- Unit 42
- Organizations
- Palo Alto NetworksUnit 42CNCF
- Countries
- US
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-22278 | Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations | 4.3 | <1% |
From the original article
7 min read at unit42.paloaltonetworks.com
In a recent audit of open-source web applications, threat researchers from Unit 42 have identified a broken object-level authorization (BOLA) vulnerability that impacts Harbor versions prior to 2. 9. 5.
By Ravid Mazon, Jay Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.