CVE-2019-9733

published 2019-04-11

CVE-2019-9733: An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an…

Priority P1 90 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

An issue was discovered in JFrog Artifactory 6.7.3. By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console. This is only allowable from a connection directly from localhost, but providing a X-Forwarded-For HTTP header to the request allows an unauthenticated user to login with the default credentials of the access-admin account while bypassing the whitelist of allowed IP addresses. The access-admin account can use Artifactory's API to request authentication tokens for all users including the admin account and, in turn, assume full control of all artifacts and repositories managed by Artifactory.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
jfrog	artifactory	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /artifactory/ui/auth/login?_spring_security_remember_me=false↗

other X-Forwarded-For: 127.0.0.1↗

command {"user":"access-admin","password":"password","type":"login"}

• → Detect unauthenticated POST requests to the Artifactory login endpoint with an X-Forwarded-For header spoofing 127.0.0.1 and a body containing the 'access-admin' username ↗
• → Alert on successful (HTTP 200) login responses containing '"username": "access-admin"' in the response body, indicating successful bypass exploitation
• → Monitor for the presence of both X-Forwarded-For and X-Requested-With: artUI headers in requests to /artifactory/ui/auth/login, which is the attack pattern for this bypass
• → Flag any API calls to request authentication tokens for all users (including admin) originating from the access-admin account, as this is the post-exploitation step following the bypass

• · The bypass only works because the access-admin account uses default credentials ('password'). Changing the default password of the access-admin account mitigates the risk even if the IP whitelist bypass via X-Forwarded-For is present. ↗
• · The IP whitelist restriction (localhost-only) for the access-admin account is bypassable via the X-Forwarded-For header, meaning network-level controls alone are insufficient without patching. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.