Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
-
Attackers chained two vulnerabilities in JFrog Artifactory, the repository that many software build pipelines pull from, to seize administrator control of self-hosted servers and plant backdoors, according to a report from cloud security company Wiz.
Wiz observed the attacks between August 15 and September 8. JFrog had already fixed both flaws before that window, meaning only servers that had not been updated remained exposed to exploitation.
Key points:
- Target: self-hosted JFrog Artifactory instances
- Outcome: administrator control of the server and backdoor installation
- Attack window observed by Wiz: August 15 to September 8
- Both vulnerabilities were patched by JFrog prior to the observed attacks
- Risk is limited to instances that were left unpatched
Mitigation:
- Update self-hosted JFrog Artifactory deployments to a version containing the fixes for both flaws
- Treat any instance that was unpatched during the attack window as potentially compromised and review it for signs of unauthorized administrative access or backdoors
Source: The Hacker News
Has your organization already patched its self-hosted Artifactory instances, or are you still working through the update?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login