Harbor vulnerabilities

The Ping() function in ui/api/target.go in Harbor through version 1.3.0-rc4 has an SSRF vulnerability via the endpoint parameter to /api/targets/ping.

A wide range of Harbor versions allow SSRF via its webhook delivery component, which does not properly validate webhook target addresses, allowing use of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a private internal address; when a project event fires, Harbor jobservice makes unauthenticated outbound HTTP POST requests to the target, and error response bodies are written to the webhook execution log readable by project members.

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts.