CVE-2020-13788 — harbor
MEDIUMCVE-2020-13788 is a medium-severity (CVSS 4.3) Server-Side Request Forgery (SSRF) vulnerability in github.com/goharbor/harbor. A fix is available for github.com/goharbor/harbor — see the affected versions and patch details below.
Harbor is vulnerable to a limited Server-Side Request Forgery (SSRF) (CVE-2020-13788)
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2020-13788 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
github.com/goharbor/harborReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Impact
Matt Hamilton from Soluble has discovered a limited Server-Side Request Forgery (SSRF) that allowed Harbor project owners to scan the TCP ports of hosts on the Harbor server's internal network.
The vulnerability was immediately fixed by the Harbor team.
Issue
The “Test Endpoint” API, part of the functionality for ensuring a project Webhook is accessible and functional, is vulnerable to a limited SSRF attack. A malicious user that is also a project administrator can use this API for internal port scanning.
Known Attack Vectors
Successful exploitation of this issue will lead to bad actors identifying open TCP ports on any network that is accessible by the Harbor core services
Patches
If your product uses the affected releases of Harbor, update to version 2.0.1 to patch this issue immediately.
https://github.com/goharbor/harbor/releases/tag/v2.0.1
Workarounds
Since only project administrators (the user that created the project) are allowed to test the webhook endpoints configured in Harbor, a Harbor system administrator can control who is a project admin. In addition, Harbor system administrators can enforce a setting where only an administrator is allowed to create new projects instead of the default Everyone. This further restricts who can be a project administrator in Harbor.
For more information
If you have any questions or comments about this advisory, contact [email protected] View our security policy at https://github.com/goharbor/harbor/security/policy https://nvd.nist.gov/vuln/detail/CVE-2020-13788 https://www.soluble.ai/blog/harbor-ssrf-cve-2020-13788
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/goharbor/harbor | ≥ 1.8.0&&< 2.0.1 | 2.0.1go get github.com/goharbor/harbor@v2.0.1 |
Affected Products
harborlinuxfoundationDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/goharbor/harbor, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/goharbor/harbor to 2.0.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2020-13788 is resolved across your whole dependency graph.
Workarounds
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.
Frequently Asked Questions
Is CVE-2020-13788 in your dependencies?
Find it across Go, including transitive dependencies.