## https://sploitus.com/exploit?id=7B7FFAA9-BDDD-5D11-B6DE-7DAE49C3F5D6
# CVE-2019-16097-batch
## Disclaimer
This tool is intended for use in security research only. Please do not use it for illegal testing; any consequences are your own! CVE-2019-16097-batch
**Batch Vulnerability Exploitation Script**
Add target addresses in bulk using the `url.txt` file.
HTTP://1.1.1.1
HTTP://2.2.2.2
Run this script using Python. You can see the final verification results in `result.txt`.
## Vulnerability Background
Recently, the Harbor image repository was exposed to a vulnerability where an attacker could construct specific strings in requests, allowing them to create administrator accounts without authorization, thereby taking control of the Harbor image repository. We immediately verified this vulnerability. The official community has issued a statement indicating that versions 1.7.6 and 1.8.3 now address this vulnerability. Users who use these versions should upgrade to the secure versions as soon as possible.
## Vulnerability Description
Harbor is an enterprise-level Registry server used for storing and distributing Docker images. There is a security vulnerability in the `core/api/user.go` file of Harbor versions 1.7.0 to 1.8.2. Attackers can exploit this vulnerability by adding key parameters to requests, allowing them to create administrator accounts and take control of the Harbor image repository.
## Affected Versions
Harbor versions 1.7.0 to 1.8.2
## Vulnerability Reproducibility
We successfully reproduced this vulnerability by writing a batch verification script. [](https://www.youtube.com/watch?v=435)
## Security Recommendations
Upgrade Harbor to version 1.7.6 and 1.8.3.
Refer to the download link: https://github.com/goharbor/harbor/releases
## Reference Links
https://github.com/evilAdan0s/CVE-2019-16097
https://github.com/goharbor/harbor/issues/8951
https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/
[source-iocs-preserved url=http://1.1.1.1,http://2.2.2.2,http://91xx.org/wp-content/uploads/2019/09/image-1569005087488.png]