CVE-2022-31670: 
Harbor vulnerability analysis and mitigation

Harbor, an open-source artifact registry by VMware, was found to contain a vulnerability (CVE-2022-31670) where it fails to validate user permissions when updating tag retention policies. The vulnerability was discovered in 2022 and affects Harbor versions 1.x<=1.10.12, 2.x<=2.4.2, and 2.5<=2.5.1. This security flaw is classified as a high-severity access control vulnerability (GitHub Advisory, Help Net Security).

The vulnerability is related to the API endpoint PUT /retentions/{id} and has been assigned a CVSS v3.1 base score of 7.7 (High). The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, indicating network vector attack, low attack complexity, low privileges required, no user interaction needed, changed scope, high impact on integrity, but no impact on confidentiality or availability (GitHub Advisory).

When exploited, this vulnerability allows an attacker to modify tag retention policies configured in other projects that they don't have access to. The vulnerability occurs because Harbor only validates the requesting user's access to the project ID specified in the request but fails to validate that the requested webhook ID belongs to the specified project ID (GitHub Advisory).

The vulnerability can be exploited by sending a request to update a tag retention policy with an ID that belongs to a project that the currently authenticated user doesn't have access to. The attack requires low complexity and only low-level privileges to execute (GitHub Advisory).

The vulnerability has been patched in Harbor versions 1.10.13+, 2.4.3+, and 2.5.2+. Users are advised to upgrade to these or later versions as soon as possible. No workarounds are available for this vulnerability (GitHub Advisory).

The vulnerability was discovered and reported by security researchers Gal Goldstein and Daniel Abeles from Oxeye Security. It was part of a series of high-severity IDOR (Insecure Director Object Reference) vulnerabilities found in the CNCF-graduated project Harbor (Help Net Security).