Sploitus

Exploit for Improper Authentication in Jfrog Artifactory

CVE-2026-82329

githubexploit · 2026-09-03

Exploit Code

README80 lines
## https://sploitus.com/exploit?id=D48C557A-56AA-5A9A-A50F-79A9660F6051
# CVE-2026-82329 — JFrog Artifactory Unauthenticated Authentication Bypass (Mass Exploit)

[![Python 3.8+](https://img.shields.io/badge/Python-3.8+-blue.svg)](https://www.python.org/)
[![CVSS](https://img.shields.io/badge/CVSS-9.8%20(Critical)-red.svg)](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)

**Critical Authentication Bypass (CVSS 9.8) — Actively Exploited in the Wild**

This tool is a **mass exploit** for CVE-2026-82329, a vulnerability that allows an **unauthenticated attacker with network access** to obtain **full administrative privileges** on self‑hosted JFrog Artifactory instances. It supports single‑target and batch scanning with multi‑threading.

---

## ⚠️ Vulnerability Overview

| Property                | Value                                                             |
|-------------------------|-------------------------------------------------------------------|
| **CVE ID**              | CVE-2026-82329                                                    |
| **CVSS Score**          | **9.8 (Critical)**                                                |
| **CWE**                 | CWE‑287 – Improper Authentication                                 |
| **Disclosure Date**     | August 28, 2026                                                   |
| **CISA KEV**            | Added September 2, 2026 (Due: September 5, 2026)                 |
| **Status**              | **Actively Exploited in the Wild**                                |

### Root Cause

In default installations, JFrog Access keeps a **blank join key** in the trusted verifier set. This empty string becomes a fully known 32‑byte HMAC secret, allowing an attacker to forge a valid cluster "join" JWT.

### Attack Chain

1. **Forge** a join JWT using the blank key (`alg=HS256`, `kid=SHA256("")`).  
2. **POST** `/access/api/v1/registry/join` — no authentication required → returns a `SERVICE` token with `admin` scope.  
3. **POST** `/access/api/v1/tokens` — uses the service token to mint a **full administrative access token**.  
4. **Use the admin token** to:
   - Read system configuration
   - List / steal all existing access tokens
   - Create admin users and repositories
   - Poison artifacts (supply‑chain attack)

---

## 📦 Affected Versions

| Branch   | Affected Versions                    | Fixed Version      |
|----------|--------------------------------------|--------------------|
| 7.161.x  | 7.161.0 – 7.161.19                   | **7.161.20**       |
| 7.146.x  | 7.146.0 – 7.146.36                   | **7.146.38**       |
| 7.133.x  | 7.133.0 – 7.133.28                   | **7.133.29**       |
| 7.125.x  | 7.125.0 – 7.125.19                   | **7.125.20**       |
| 7.117.x  | 7.117.0 – 7.117.27                   | **7.117.28**       |
| 7.111.x  | 7.111.4 – 7.111.20                   | **7.111.21**       |

> **JFrog Cloud is NOT affected** — only self‑managed instances.

---

## 🚀 Features

- ✅ **Single‑target mode** (`-u`)
- âś… **Batch scanning** from file (`-f targets.txt`)
- ✅ **Multi‑threading** (`-t 20`)
- ✅ **Automatic proof of admin** — verifies token by accessing admin‑only endpoints
- âś… **Persistent admin user creation** (`--create-admin USER:PASS`)
- ✅ **Token‑only mode** (`--token-only`) for scripting
- ✅ **Progress bar** with spinner and real‑time stats
- âś… **Output files**:
  - `artifactory_pwned.txt` — vulnerable targets with admin tokens
  - `artifactory_failed.txt` — failed targets with error reasons

---

## đź“Ą Installation

```bash
# Clone the repository
git clone https://github.com/0xCyp1337/CVE-2026-82329.git
cd CVE-2026-82329
python3 CVE-2026-82329.py -h

# No external dependencies — uses Python standard library only
# Tested on Python 3.8+