CVE-2020-13794: 
Harbor vulnerability analysis and mitigation

Harbor versions 1.9., 1.10., and 2.0.* contain a user enumeration vulnerability that allows exposure of sensitive information to unauthorized actors. The vulnerability was discovered by Hidde Smit from Cyber Eagle and was disclosed in September 2020 (Harbor Advisory).

The vulnerability exists in the '/users' API endpoint, which is intended to be restricted to administrators only. Non-administrator users can bypass this restriction through the search functionality. By sending a GET request to /api/users/search with the parameter 'username' and value '_' as a wildcard character, unauthorized users can enumerate all usernames and user IDs in the system (Cyber Eagle).

The vulnerability allows authenticated non-administrator users to obtain a complete list of usernames and user IDs from the system. This information could potentially be used for social engineering attacks, particularly when usernames contain email addresses (Cyber Eagle).

The vulnerability is easily exploitable by any authenticated user, including those created through self-registration. It requires only basic HTTP requests to the API endpoint with specific query parameters (Harbor Advisory).

The vulnerability has been patched in Harbor versions 2.0.3 and 2.1.0. In the patched versions, username is required for search functionality and support for querying by email has been removed. There are no workarounds available for this issue; upgrading to a patched version is the only solution (Harbor Advisory).