CVE-2024-22261

Executive Summary

CVE-2024-22261 is a SQL Injection vulnerability in the Harbor container registry platform. It allows an authenticated user with administrative privileges to leak task IDs from the database. The vulnerability has a low CVSS score of 2.7 due to the high privileges required and limited impact (only information disclosure of task IDs). No public proof-of-concept or exploit code is available at this time. The vendor has not released a patch or official advisory.

Supply Chain & Package Security

Harbor is a Go-based application. The vulnerability exists in the backend API layer, likely in a handler that constructs SQL queries with user-supplied input. Since Harbor is distributed as a container image, the supply chain risk is moderate; users should verify image signatures and checksums from official sources.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (task IDs leaked)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. Exploitation requires administrative credentials, and the impact is limited to leaking task IDs. However, task IDs could be used in further attacks to track or manipulate jobs.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the Harbor API. An authenticated administrator can send a crafted request to an endpoint that queries the database for task information. The input is not properly sanitized, allowing the attacker to inject SQL commands that modify the query to return additional data (task IDs).

The vulnerable code likely looks like:

func getTasks(db *sql.DB, taskID string) ([]Task, error) {
    query := fmt.Sprintf("SELECT * FROM tasks WHERE id = '%s'", taskID)
    rows, err := db.Query(query)
    // ...
}

The attacker can provide a taskID like ' OR 1=1-- to retrieve all task IDs.

Vulnerable vs. Patched Code

Vulnerable Code (Go):

func getTaskDetails(db *sql.DB, taskID string) (Task, error) {
    query := fmt.Sprintf("SELECT id, name, status FROM tasks WHERE id = '%s'", taskID)
    row := db.QueryRow(query)
    // ...
}

Patched Code (Go):

func getTaskDetails(db *sql.DB, taskID string) (Task, error) {
    query := "SELECT id, name, status FROM tasks WHERE id = ?"
    row := db.QueryRow(query, taskID)
    // ...
}

The patched version uses parameterized queries, preventing SQL injection.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable Harbor instance (version < 2.9.0) in a lab environment.
2. Authenticate: Obtain admin credentials (e.g., admin:Harbor12345).
3. Exploit: Send a crafted API request to the vulnerable endpoint:

curl -k -u "admin:Harbor12345" \
  "https://harbor.example.com/api/v2.0/projects/1/repositories/1/artifacts/1/tasks?id=' OR '1'='1"

4. Extract Data: The response will include all task IDs in the database.

Blue Team

1. Monitor: Look for SQL injection patterns in API logs (e.g., ' OR, 1=1, --).
2. Detect: Use WAF rules to block suspicious SQL keywords in API parameters.
3. Audit: Review database query logs for unexpected SELECT statements.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/v2.0/projects/*/repositories/*/artifacts/*/tasks with SQL-like payloads in the id parameter.
• Logs: Database query logs showing SELECT * FROM tasks WHERE id = ' followed by SQL injection patterns.
• File: No file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_22261_Harbor_SQLi {
    meta:
        description = "Detects SQL injection attempts against Harbor task API"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-22261"
    strings:
        $sqli1 = /id=['\"]?.*(?:OR|or|Or).*['\"]?/
        $sqli2 = /id=['\"]?.*(?:1=1|1=2).*['\"]?/
        $sqli3 = /id=['\"]?.*--/
    condition:
        any of them
}

Sigma Rule

title: Harbor SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Harbor task API
author: Valters IT
logsource:
    category: webserver
    product: harbor
detection:
    selection:
        cs-uri-query|contains:
            - "id=' OR"
            - "id=1=1"
            - "id=--"
    condition: selection
falsepositives:
    - Legitimate use of special characters in task IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22261 Harbor SQL Injection Attempt"; flow:to_server; content:"/api/v2.0/projects/"; content:"/repositories/"; content:"/artifacts/"; content:"/tasks"; content:"id="; pcre:"/id=['\"]?.*(?:OR|or|Or).*['\"]?/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict API access to trusted IPs and enforce strong authentication.
2. Short-term: Apply input validation and parameterized queries to the vulnerable endpoint.
3. Long-term: Upgrade to a patched version of Harbor once available.
4. Workaround: Use a Web Application Firewall (WAF) to block SQL injection patterns.

Valters IT
Securing Digital Frontiers