Full Chain Pre-Auth RCE on JFrog Artifactory

by

Author: Edra (edrabb.fr — Bug Bounty, Pentest, CTF)
Published: August 9, 2026
Source: https://edrabb.fr/posts/full-chain-preauth-rce-jfrog-artifactory/

Summary

Edra documents a five-step, pre-authentication remote code execution chain against JFrog Artifactory that goes from zero credentials to command execution with no prerequisites (no anonymous-access setting, repository, user permission, or license required). The write-up is framed around AI-assisted vulnerability research: after JFrog Artifactory zero-days were surfaced during OpenAI’s “ExploitGym” evaluation (the author cites a July 27, 2026 announcement and a batch of nine CVEs), the author reused a long-running multi-agent prompt from Adam Kues (Searchlight Cyber) — originally used to find a WordPress pre-auth RCE with an LLM — pointed a coding agent (Codex) at Artifactory’s decompiled source, and had the full chain reconstructed in about four hours, then verified and reproduced it by hand. One link in the chain is identified as CVE-2026-65616 (CVSS 8.8); the surrounding steps correspond to additional CVEs disclosed the same day. The findings are described as verified and reproduced, not theoretical. This summary describes the mechanism and fix for defensive purposes and deliberately omits the article’s copy-paste exploit commands and payloads.

Technical Details

The chain composes several independent weaknesses:

  • Trailing-slash authentication bypass. An internal JFrog Access AWS token-exchange endpoint requires authentication, but appending a trailing slash to the path causes Spring Security’s exact-path matcher and Jersey’s request dispatch to disagree: the request slips past the auth filter while still reaching the handler. Access then issues a legitimately signed JWT for the built-in anonymous user with a wildcard audience.
  • Anonymous token to refreshable token. Presenting that anonymous JWT lets the attacker request a refreshable token, obtaining both an access token and a refresh-token secret.
  • Admin JWT forgery via claim confusion (CVE-2026-65616). The attacker crafts a token carrying admin scope with an invalid signature. When submitted to Artifactory’s token-refresh endpoint together with the valid refresh secret, the endpoint validates the refresh secret but trusts the claims copied from the unverified access-token parameter, then re-requests the token from Access under its own service-admin identity. Access binds only the subject and signs the requested admin scope, returning a genuinely signed super-admin token. The forged signature is never meaningfully checked — the flaw is trusting attacker-supplied claims during refresh.
  • Admin-to-RCE via Logback + Tomcat CGI. With admin access, the attacker uploads a system-import archive containing a crafted Logback configuration. Logback’s file-writing behaviour is abused to drop a Tomcat web.xml that registers the CGI servlet (mapped to a shell), a CGI script, and a privileged context descriptor; a configuration-reload watchdog and a Tomcat redeploy then bring the CGI servlet live, yielding command execution as the artifactory service account. Triggering the import with a content-exclusion flag reportedly bypasses the license check, so this path needs no Artifactory license. On Pro/Enterprise instances a simpler alternative is noted: deploy a Groovy user plugin that runs a command.

Impact

An unauthenticated, network-adjacent attacker who can reach an affected Artifactory instance can obtain super-admin privileges and then execute arbitrary OS commands as the Artifactory service user — a full pre-auth compromise of the artifact repository. Because Artifactory is a central software-supply-chain component (storing build artifacts, packages, and Docker images and holding credentials to downstream systems), takeover carries outsized risk: tampering with or poisoning artifacts, credential theft, and lateral movement into CI/CD and production. Affected: JFrog Artifactory versions prior to the fixed release below.

Mitigation

Update Artifactory to the patched version (the author states 7.161.15 or later). Where an immediate upgrade isn’t possible, the article notes that setting any one of the following JFrog Access options breaks the chain: disable wildcard token audiences (token.allow-wildcard-audience=false), disable refreshable tokens (token.allow-refreshable=false), or disable system import (artifactory.system.import.enabled=false). Defenders should also restrict network exposure of Artifactory/Access endpoints and review logs for anonymous token issuance, unexpected admin-scope token refreshes, and system-import activity. As always, treat affected-version and CVSS details as reported by the source and confirm against JFrog’s official advisory before acting.

References

Leave a Comment