GHSA-h27m-3qw8-3pw8 CVE-2025-30086 GO-2025-3826
Possible ORM Leak Vulnerability in the Harbor
- Severity
- 4.9 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.71%
- Chance of exploitation in the next 30 days. Higher than 53.72% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-202 Exposure of Sensitive Information Through Data Queries
- Fix
2.13.1- Upgrade github.com/goharbor/harbor to this version or later
Description
Impact
Administrator users on Harbor could exploit an ORM Leak (https://www.elttam.com/blog/plormbing-your-django-orm/) vulnerability that was present in the /api/v2.0/users endpoint to leak users' password hash and salt values. This vulnerability was introduced into the application because the q URL parameter allowed the administrator to filter users by any column, and the filter password=~ could be abused to leak out a user's password hash character by character.
An attacker with administrator access could exploit this vulnerability to leak highly sensitive information stored on the Harbor database, as demonstrated in the attached writeup by the leaking of users' password hashes and salts. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack, and could potentially be exploitable by lower privileged users to gain unauthorised access to other sensitive information.
Patches
No available
Workarounds
NA
References
Credit
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/goharbor/harbor | >= 2.13.0, < 2.13.1 |
2.13.1 |
| github.com/goharbor/harbor | >= 2.4.0-rc1.1, < 2.12.4 |
2.12.4 |
| github.com/goharbor/harbor | < 2.4.0-rc1.0.20250331071157-dce7d9f5cffb |
2.4.0-rc1.0.20250331071157-dce7d9f5cffb |
| github.com/goharbor/harbor | < 2.12.4+incompatible>= 2.13.0+incompatible, < 2.13.1+incompatible |
2.12.4+incompatible2.13.1+incompatible |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/goharbor/harbor Go → 2.13.1
- go
go get github.com/goharbor/harbor@v2.13.1 && go mod tidy
Severity breakdown
CVSS 3.1 4.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-202: Exposure of Sensitive Information Through Data Queries
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
How to prevent it
- Architecture and Design: This is a complex topic. See the [REF-1492] for a good discussion of best practices.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-prh4-vhfh-24mj Harbor: LDAP password and OIDC secret are not redacted in the audit log | Medium | Also affects github.com/goharbor/harbor |
| GHSA-hj7x-hmf2-hc2p Harbor allows the use of the default password for web UI login | Critical | Also affects github.com/goharbor/harbor |
| GHSA-f9vc-vf3r-pqqq Harbor repository description page has Cross-site Scripting vulnerability | Medium | Also affects github.com/goharbor/harbor |
| GHSA-r864-28pw-8682 Harbor fails to validate the user permissions when updating p2p preheat policies | High | Also affects github.com/goharbor/harbor |
| GHSA-hw28-333w-qxp3 Harbor fails to validate the user permissions when updating project configurations | Medium | Also affects github.com/goharbor/harbor |
| GHSA-vw63-824v-qf2j SQL Injection in Harbor scan log API | Medium | Also affects github.com/goharbor/harbor |
| GHSA-5757-v49g-f6r7 Open Redirect URL in Harbor | Medium | Also affects github.com/goharbor/harbor |
| GHSA-mq6f-5xh5-hgcf Harbor timing attack risk | Medium | Also affects github.com/goharbor/harbor |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor