Stealing the Artifact Chaining JFrog Artifactory Authenticat...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://netspi.com/blog/technical-blog/red-teaming/stealing-the-artifact-jfrog-artifactory-vulnerability
• Blog Title: Stealing the Artifact: Chaining JFrog Artifactory Authentication, Authorization, Path Traversal, and URL Parsing Vulnerabilities
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > Artifactory Hacking guide; cross-reference from Pentesting Web sections covering Login/Auth Bypass, File Inclusion/Path Traversal, IDOR, and proxy/backend path normalization discrepancies

🎯 Content Summary

Overview, severity, and impact

NetSPI discovered four JFrog Artifactory bugs that can be chained by a remote unauthenticated attacker to steal an arbitrary artifact from a repository for which the attacker has no read permission. In a simple single-container deployment, the first three bugs are sufficient when Tomcat port 8081 is reachable. A typical production deployment additionally requires the fourth bug to traverse the externally exposed jf-router/Traefi...

🔧 Technical Details

Security-filter and resource-router path mismatch: Test whether authentication filters and endpoint routers canonicalize trailing slashes, duplicate separators, encoded characters, and path parameters differently. If a filter uses an exact matcher for /endpoint but the application router also accepts /endpoint/, the alternate path may skip authentication while still reaching the protected handler. Examine what later filters do with an empty security context: a fallback anonymous identity can become dangerous when downstream code treats any populated context as authenticated or mints credentials based only on its username.

Fallback identity converted into a bearer token: A nominally anonymous principal may be represented by a real database account that inherits broad roles such as user. If a token-exchange endpoint trusts SecurityContext.getAuthentication() without proving how that identity wa...

🤖 Agent Actions

Updated src/network-services-pentesting/pentesting-web/artifactory-hacking-guide.md.

Added:

• Trailing-slash authentication filter bypass and anonymous JWT minting.
• Stash metadata ACL bypass, enumeration oracle, and session poisoning.
• Content-addressed blob authorization bypass.
• Export path traversal and constrained arbitrary-file-write analysis.
• jf-router/Tomcat ..; path-parser confusion.
• Reproducible curl examples, detection indicators, remediation versions, and internal cross-links.
• Numbered citations to NetSPI’s original research and JFrog CNA records.

Validation completed:

• git diff --check passed.
• All internal Markdown links exist.
• Citation/reference numbering matches.
• Forbidden sources are absent.
• Only the intended Artifactory page changed.
• mdbook build was unavailable because mdBook is not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://netspi.com/blog/technical-blog/red-teaming/stealing-the-artifact-jfrog-artifactory-vulnerability

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > Artifactory Hacking guide; cross-reference from Pentesting Web sections covering Login/Auth Bypass, File Inclusion/Path Traversal, IDOR, and proxy/backend path normalization discrepancies".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0