Skip to main content
CPEBuddy
Hacking a Docker Container Registry

Hacking a Docker Container Registry

Source: YouTube · John Hammond · published Jul 29, 2024 · 24:37

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

This video demonstrates CVE-2019-16097, a critical privilege escalation vulnerability in the Harbor container registry that allows non-admin or unauthenticated users to create administrator accounts via a simple API request 0:00.

Key Takeaways:
• CVE-2019-16097 affects Harbor versions prior to 1.7.6, enabling users to create admin accounts by injecting has_admin_role: true into a POST request to the /api/users endpoint 0:12 0:51.
• The vulnerability occurs because the API decodes JSON directly into a user object without validating the has_admin_role field, allowing a mass assignment attack 16:48.
• The presenter successfully exploits this using a Python script to create a new admin user named "hacker," demonstrating that no authentication or prior session is required 17:00 23:14.

This vulnerability, patched in version 1.7.6, highlights the critical importance of validating input on API endpoints to prevent unauthorized privilege escalation 21:04.

Sources:

  • 0:12 Vulnerability overview and affected versions
  • 16:48 Analysis of the mass assignment flaw
  • 17:00 Constructing the Python exploit script
  • 23:14 Verification of unauthenticated access
  • 21:04 Patch details in version 1.7.6

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

so 5 years ago this open-source container registry application had a vulnerability and in this video we'll walk through and showcase that vulnerability cve 2019 16097 in the software Harbor now this is open-source software so you can find it online at GitHub github.com slgo Harbor in the repository Harbor or on their website go harbor. now please let me say this project is still actively maintained you can see here from like a couple days ago at the time recording so it is a live and well now with that I don't mean for this showcase or this video to be perceived as any sort of ill intent or slight for them or their project I just want to showcase this as another educational demo and to note look anyone can be affected but the vulnerability cve 2019 16097 notes that in this software in the …