4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-30086

CVE-2025-30086: Possible ORM Leak Vulnerability in the Harbor

Impact

Administrator users on Harbor could exploit an ORM Leak (https://www.elttam.com/blog/plormbing-your-django-orm/) vulnerability that was present in the /api/v2.0/users endpoint to leak users' password hash and salt values. This vulnerability was introduced into the application because the q URL parameter allowed the administrator to filter users by any column, and the filter password=~ could be abused to leak out a user's password hash character by character.

An attacker with administrator access could exploit this vulnerability to leak highly sensitive information stored on the Harbor database, as demonstrated in the attached writeup by the leaking of users' password hashes and salts. All endpoints that support the q URL parameter are vulnerable to this ORM leak attack, and could potentially be exploitable by lower privileged users to gain unauthorised access to other sensitive information.

Patches

No available

Workarounds

References

Credit

alex@elttam.com

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-30086

CVE-2025-30086:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/goharbor/harbor	go	= 2.13.0	2.13.1
github.com/goharbor/harbor	go	>= 2.4.0-rc1.1, < 2.12.4	2.12.4
github.com/goharbor/harbor	go	< 2.4.0-rc1.0.20250331071157-dce7d9f5cffb	2.4.0-rc1.0.20250331071157-dce7d9f5cffb

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an ORM leak caused by improper validation of filterable fields in the Harbor application. The q query parameter, used across multiple API endpoints, allows filtering on database table columns. The core of the issue lies in the orm.metadata.Filterable function, which incorrectly determined that any existing field in a model was filterable, ignoring any security-related annotations. This allowed an attacker with knowledge of the data models to craft queries that could leak sensitive information, such as password hashes and salts from the user table, by filtering on these fields and observing the response.

The provided patch addresses this vulnerability at its source. First, it modifies the orm.metadata.Filterable function to correctly respect a filter:\"false\" tag on model fields. Second, it adds this tag to sensitive fields in several models, including user, oidc_user, robot, and registry, effectively preventing them from being used in filters. The orm.setFilters function, which consumes the Filterable logic, is where the user-provided query is processed, making it a critical function in the execution flow of an attack. Any runtime profile during exploitation would show calls to orm.setFilters and orm.metadata.Filterable when the malicious query is being processed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.