Threats tagged 'ghsa-h7v4-fjg7-95fc'

Certain versions of Harbor contain a server-side request forgery (SSRF) vulnerability in the webhook delivery component. This flaw allows an authenticated attacker with ProjectAdmin permissions to configure webhook policies targeting private or link-local IP addresses. When triggered, Harbor's jobservice sends unauthenticated HTTP POST requests to these internal addresses. If the target responds with an error, the response body is logged and accessible to project members, potentially exposing sensitive internal resources such as cloud metadata services.