JFrog Artifactory < 7.146.27 Privilege Escalation

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(367888);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id("CVE-2026-65616");

  script_name(english:"JFrog Artifactory < 7.146.27 Privilege Escalation");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote host is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to
7.146.27. It is, therefore, affected by a privilege escalation vulnerability in the refresh-token signature due to
incorrect validation. An authenticated, remote attacker can exploit this to gain administrator access to the system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases");
  script_set_attribute(attribute:"see_also", value:"https://docs.jfrog.com/releases/docs/jfrog-security-advisories");
  script_set_attribute(attribute:"solution", value:
"Upgrade to JFrog Artifactory version 7.146.27 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-65616");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/20");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jfrog:artifactory");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jfrog_artifactory_win_installed.nbin", "jfrog_artifactory_nix_installed.nbin");
  script_require_keys("installed_sw/Artifactory");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Artifactory', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '7.146.27'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);