JFrog Artifactory Chained Exploit Grants Admin Access: Detection, Hunting, and Remediation for Self-Hosted Servers

---
title: Artifactory Tomcat Process Spawning Shell or Command Interpreter
id: 3f8a2c71-9b4e-4d12-a6f0-7c1e5d9b2a48
status: experimental
description: Detects the Artifactory/Tomcat Java process spawning shells, downloaders, or scripting interpreters, consistent with web shell execution following chained exploitation of JFrog Artifactory flaws.
references:
  - https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/artifactory/'
      - '/tomcat/'
    ParentCommandLine|contains:
      - 'artifactory'
      - 'catalina'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Artifactory backup or maintenance scripts executed via cron under the artifactory user — verify parent chain is systemd/cron rather than Tomcat
level: high
---
title: Suspicious JSP File Creation in Artifactory Tomcat Webapps Directory
id: 8c1d4e62-3a7f-4b95-9d21-5e6a8c0f3b17
status: experimental
description: Detects creation or modification of JSP files inside the Artifactory Tomcat webapps directory, a strong indicator of web shell deployment following administrative compromise of self-hosted Artifactory.
references:
  - https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/artifactory/app/artifactory/tomcat/webapps/'
      - '/opt/jfrog/artifactory/'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate Artifactory upgrades redeploy WAR/JSP content — correlate with scheduled maintenance windows and upgrade logs
level: high
---
title: Artifactory Admin Token or User Creation in Audit Logs
id: 5b9e7a34-2c6d-4f18-b3a0-9d4c1e7f6a52
status: experimental
description: Detects creation of access tokens, API keys, or new user accounts recorded in Artifactory access/audit logs, which may indicate rogue persistence established after admin-level compromise.
references:
  - https://thehackernews.com/2026/09/attackers-chain-jfrog-artifactory-flaws.html
  - https://attack.mitre.org/techniques/T1136/
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1136
  - attack.t1098
logsource:
  category: application
  product: jfrog
detection:
  selection:
    Message|contains:
      - 'create token'
      - 'token created'
      - 'create user'
      - 'user created'
      - 'POST /access/api/v1/tokens'
      - 'POST /artifactory/api/security/users'
      - 'PUT /artifactory/api/security/users'
  condition: selection
falsepositives:
  - Legitimate CI service-account provisioning — baseline expected token creation sources (automation IPs, IaC pipelines) and alert on deviations
level: medium

// Hunt 1: Artifactory/Tomcat spawning suspicious child processes (web shell behavior)
DeviceProcessEvents
| where TimeGenerated >= datetime(2026-08-15)
| where InitiatingProcessCommandLine has_any ("artifactory", "catalina", "tomcat")
    or InitiatingProcessFolderPath has_any ("artifactory", "tomcat")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "python", "python3", "perl", "nc", "ncat", "base64", "cmd.exe", "powershell.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Hunt 2: Artifactory audit events indicating token/user creation (via Syslog/CEF ingestion)
Syslog
| where TimeGenerated >= datetime(2026-08-15)
| where SyslogMessage has_any ("POST /access/api/v1/tokens", "/artifactory/api/security/users", "token created", "user created")
| project TimeGenerated, Computer, HostIP, SyslogMessage
| order by TimeGenerated desc;

// Hunt 3: Outbound network connections from Artifactory Java process to rare external destinations
DeviceNetworkEvents
| where TimeGenerated >= datetime(2026-08-15)
| where InitiatingProcessFileName =~ "java" and InitiatingProcessCommandLine has "artifactory"
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteUrl, RemoteIP, RemotePort
| where ConnectionCount < 50  // rare destinations — repositories see high volume to known upstreams
| order by FirstSeen asc;

-- Hunt: Artifactory web shell artifacts and suspicious Tomcat child processes
-- Artifact: SecurityArsenal.Artifactory.CompromiseSweep

-- Part 1: Recently modified JSP/WAR files in the Tomcat webapps tree
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['/opt/jfrog/artifactory/**/tomcat/webapps/**/*.jsp',
                 '/opt/jfrog/artifactory/**/tomcat/webapps/**/*.jspx',
                 '/opt/jfrog/artifactory/**/tomcat/webapps/**/*.war',
                 '/var/opt/jfrog/artifactory/**/webapps/**/*.jsp'])
WHERE Mtime > '2026-08-01'
ORDER BY Mtime DESC

-- Part 2: Suspicious child processes of java/Tomcat (run as separate hunt or join)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(sh|bash|curl|wget|python|perl|nc|ncat)$'
  AND Ppid IN (
      SELECT Pid FROM pslist()
      WHERE CommandLine =~ '(artifactory|catalina|tomcat)'
  )

#!/bin/bash
# Security Arsenal - Artifactory chained-exploit verification & hardening script
# Run as root or with sudo on each self-hosted Artifactory node.

set -euo pipefail

JFROG_HOME="${JFROG_HOME:-/opt/jfrog/artifactory}"
MIN_PATCHED_VERSION="7.XX.X"   # <-- SET from JFrog security advisory for your train
REPORT="/tmp/artifactory_ir_sweep_$(date +%Y%m%d_%H%M%S).txt"

echo "=== Artifactory IR Sweep $(date -u) ===" | tee "$REPORT"

# 1. Version check — confirm installed version meets or exceeds the patched baseline
echo -e "\n[1] Installed Artifactory version:" | tee -a "$REPORT"
INSTALLED=$(grep -oPm1 '(?<=<version>)[^<]+' "$JFROG_HOME/app/artifactory/tomcat/webapps/artifactory/WEB-INF/classes/artifactory.version" 2>/dev/null \
  || curl -s -u admin:ADMIN_PASSWORD http://localhost:8081/artifactory/api/system/version 2>/dev/null \
  || echo "UNKNOWN - check via UI: Administration > Monitoring > Service Status")
echo "Installed: $INSTALLED | Minimum patched: $MIN_PATCHED_VERSION" | tee -a "$REPORT"

# 2. Web shell sweep — JSP/WAR files modified since Aug 1, 2026 in Tomcat tree
echo -e "\n[2] JSP/WAR files modified since 2026-08-01 (investigate ANY hit):" | tee -a "$REPORT"
find "$JFROG_HOME" -path '*/tomcat/webapps/*' \( -name '*.jsp' -o -name '*.jspx' -o -name '*.war' \) \
  -newermt '2026-08-01' -ls 2>/dev/null | tee -a "$REPORT" || echo "None found" | tee -a "$REPORT"

# 3. Suspicious process lineage — shells/tools parented by java/tomcat
echo -e "\n[3] Suspicious child processes of java/tomcat:" | tee -a "$REPORT"
ps -eo pid,ppid,comm,args --forest | grep -E 'java|artifactory|catalina' -A2 | \
  grep -E '\b(sh|bash|dash|curl|wget|python|perl|nc|ncat|base64)\b' | tee -a "$REPORT" || \
  echo "None found" | tee -a "$REPORT"

# 4. Unexpected outbound connections from the Artifactory java process
echo -e "\n[4] Established outbound connections from java (review for non-repository destinations):" | tee -a "$REPORT"
JPID=$(pgrep -f 'artifactory|catalina' | head -5 | tr '\n' '|' | sed 's/|$//')
if [ -n "$JPID" ]; then
  ss -tnp state established | grep -E "pid=($JPID)" | awk '{print $5, $NF}' | sort -u | tee -a "$REPORT"
else
  echo "Artifactory java process not found - is the service running?" | tee -a "$REPORT"
fi

# 5. Local user / persistence review
echo -e "\n[5] Recently created local accounts (since 2026-08-01):" | tee -a "$REPORT"
awk -F: '$3 >= 1000 {print $1}' /etc/passwd | while read -r u; do
  CH=$(chage -l "$u" 2>/dev/null | awk -F': ' '/Last password change/{print $2}')
  echo "$u (last pw change: $CH)" | tee -a "$REPORT"
done

# 6. Artifactory-side review checklist (manual, via UI/API)
echo -e "\n[6] MANUAL STEPS REQUIRED in Artifactory UI/API:" | tee -a "$REPORT"
cat <<'EOF' | tee -a "$REPORT"
  a) Administration > Identity and Access > Users: enumerate ALL admin accounts;
     remove any not attributable to your team. Check creation dates.
  b) Administration > Identity and Access > Access Tokens: revoke ALL tokens
     created since 2026-08-01 that cannot be tied to automation. When in doubt,
     revoke and reissue.
  c) Review $JFROG_HOME/var/log/access/ and audit logs for POST /access/api/v1/tokens
     and /api/security/users calls from unexpected source IPs since 2026-08-01.
  d) Rotate ALL credentials stored in or used by Artifactory: repository replication
     passwords, docker/registry credentials, CI service accounts, signing keys.
EOF

echo -e "\nSweep complete. Report: $REPORT" | tee -a "$REPORT"
echo "If section [2] or [3] returned ANY results: isolate the host, preserve the report and logs, and initiate your IR process before patching — evidence first."