PT-2019-19828 · Jfrog · Jfrog Artifactory

Published 2019-04-11 · Updated 2020-08-24 · CVE-2019-9733

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JFrog Artifactory version 6.7.3

Description An issue in JFrog Artifactory allows an unauthenticated user to login with the default credentials of the access-admin account by providing a X-Forwarded-For HTTP header to the request, bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users, including the admin account, and assume full control of all artifacts and repositories managed by Artifactory.

Recommendations For JFrog Artifactory version 6.7.3, consider disabling the access-admin account or restricting its access until a patch is available. As a temporary workaround, restrict access to the API endpoints that allow requesting authentication tokens for all users. Avoid using the default credentials of the access-admin account until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2019-9733

Affected Products

Jfrog Artifactory

References · 6

• 🔥 https://ciphertechs.com/jfrog-artifactory-advisory · Exploit
• 🔥 http://packetstormsecurity.com/files/152172/JFrog-Artifactory-Administrator-Authentication-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9733 · Security Note
• https://jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory6.8.6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9733 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9733 · Note