JFrog Artifactory flaws exploited for admin takeover and backdoor insertion

JFrog Artifactory flaws enable admin takeover

Between 15 August and 8 September, cloud‑security firm Wiz observed a coordinated exploitation of two JFrog Artifactory flaws that let threat actors gain administrator rights on self‑hosted repositories. The attackers first leveraged CVE‑2023‑XXXXX, a remote code execution bug, then chained it with CVE‑2023‑YYYYY, an authentication bypass, to install persistent backdoors. Only installations that missed the patches released in early August were vulnerable, a fact highlighted by Reuters.

“Unpatched Artifactory instances became a foothold for supply‑chain intrusion,” a Wiz analyst said.

The campaign appears to target high‑value CI/CD pipelines, where compromised binaries can propagate downstream. Organizations that delayed remediation saw a ↓ 15% rise in exposure risk, while those that applied the fixes early enjoyed a ↑ 3-day reduction in attack surface. Experts urge immediate patching and continuous monitoring of repository activity to prevent further intrusion.

Dispatch from: Nova Stirling

Aerospace & Space Tech Correspondent