JFrog Artifactory up to 4.15 ui/artifact/upload unrestricted upload

Summaryinfo

A vulnerability classified as critical has been found in JFrog Artifactory up to 4.15. Affected by this vulnerability is an unknown functionality of the file ui/artifact/upload. Performing a manipulation results in unrestricted upload. This vulnerability is cataloged as CVE-2016-10036. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in JFrog Artifactory up to 4.15. It has been classified as critical. This affects some unknown processing of the file ui/artifact/upload. The manipulation with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Unrestricted file upload vulnerability in ui/artifact/upload in JFrog Artifactory before 4.16 allows remote attackers to (1) deploy an arbitrary servlet application and execute arbitrary code by uploading a war file or (2) possibly write to arbitrary files and cause a denial of service by uploading an HTML file.

The bug was discovered 04/20/2018. The weakness was shared 05/01/2018 as EDB-ID 44543 as not defined exploit (Exploit-DB). The advisory is shared at exploit-db.com. This vulnerability is uniquely identified as CVE-2016-10036 since 12/23/2016. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.

After immediately, there has been an exploit disclosed. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 11 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 4.16 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (44543). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• JFrog

Name

• Artifactory

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion