Exploitation Summary
EIP tracks 6 public exploits for CVE-2019-16097. PoCs published by evilAdan0s, rockmelodies, luckybool1020. A Nuclei detection template is also available.
AI-analyzed exploit summary The PoC exploits CVE-2019-16097 in Harbor by sending a crafted JSON payload to the `/api/users` endpoint, allowing an attacker to create an admin account. The script checks for a 201 status code to confirm vulnerability.
Description
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
Exploits (6)
The PoC exploits CVE-2019-16097 in Harbor by sending a crafted JSON payload to the `/api/users` endpoint, allowing an attacker to create an admin account. The script checks for a 201 status code to confirm vulnerability.
The repository contains a functional Python script that exploits CVE-2019-16097, an arbitrary admin registration vulnerability in Harbor. The script sends a crafted POST request to create an admin account without authentication.
This repository contains a functional exploit for CVE-2019-16097, an unauthenticated privilege escalation vulnerability in Harbor. The PoC leverages the Harbor API to create an admin user without authentication, demonstrating the vulnerability's impact.
This repository contains a functional exploit for CVE-2019-16097, which allows unauthenticated user creation via a POST request to the `/api/users` endpoint. The script automates the process by reading target URLs from a file and writing results to an output file.
This repository contains a functional exploit for CVE-2019-16097, which allows an attacker to add an admin user in Harbor by sending a crafted POST request to the `/api/users` endpoint with the parameter `"has_admin_role":true`. The script supports both single-target and batch exploitation.
The repository contains a functional Python script that exploits CVE-2019-16097, an arbitrary admin registration vulnerability in Harbor. The script sends a crafted POST request to create an admin account without authentication.
Nuclei Templates (1)
http.favicon.hash:657337228
icon_hash=657337228
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N