CVE-2026-66384: JFrog Artifactory Path Traversal (CWE-22) Exploitation

let traversalPatterns = dynamic(["..%2f","..%5c","%2e%2e%2f","%2e%2e/","..\\/","..%252f","%00","/etc/passwd","master.key","/access/etc","artifactory.config"]);
let rawTraversal = @'(\.\./|\.\.\\|\.\.%2[fF]|%2[eE]%2[eE])';
union isfuzzy=true W3CIISLog, AzureDiagnostics, CommonSecurityLog
| extend reqUri = tostring(coalesce(column_ifexists("csUriStem",""), column_ifexists("requestUri_s",""), column_ifexists("requestUrl",""))),
         reqQuery = tostring(coalesce(column_ifexists("csUriQuery",""), column_ifexists("requestQuery_s",""))),
         clientIp = tostring(coalesce(column_ifexists("cIP",""), column_ifexists("clientIP_s",""), column_ifexists("SourceIP",""))),
         httpStatus = tostring(coalesce(column_ifexists("scStatus",""), column_ifexists("httpStatus_d","")))
| where reqUri has_any ("/artifactory","/access","/ui/api") or reqUri contains "artifactory"
| extend combined = strcat(reqUri, "?", reqQuery)
| where combined matches regex rawTraversal or combined has_any (traversalPatterns)
| project TimeGenerated, clientIp, reqUri, reqQuery, httpStatus, combined
| summarize attempts = count(), sampleUris = make_set(reqUri, 10), statuses = make_set(httpStatus, 10) by clientIp
| where attempts >= 1
| order by attempts desc

index=web (sourcetype="jfrog:artifactory:access" OR sourcetype="nginx:plus:access" OR sourcetype="iis" OR sourcetype="apache:access")
(uri="*artifactory*" OR uri="*/access*" OR uri="*/ui/api*")
| eval combined=uri."?".coalesce(uri_query,"")
| regex combined="(?i)(\.\./|\.\.\\|\.\.%2f|%2e%2e%2f|%2e%2e/|%00|/etc/passwd|master\.key)"
| stats count as attempts values(uri) as sample_uris values(status) as statuses dc(uri) as distinct_uris by src_ip
| where attempts>=1
| sort - attempts

any where event.category == "web" and
  (url.path : "*artifactory*" or url.path : "*/access*" or url.path : "*/ui/api*") and
  (
    url.path : ("*../*", "*..%2f*", "*%2e%2e%2f*", "*..\\*", "*%00*") or
    url.query : ("*../*", "*..%2f*", "*%2e%2e%2f*", "*/etc/passwd*", "*master.key*") or
    url.original : ("*../..*", "*%2e%2e%2f*")
  )

SELECT sourceip, url, "URL Query" AS urlquery, COUNT(*) AS attempts
FROM events
WHERE (LOWER(url) LIKE '%artifactory%' OR LOWER(url) LIKE '%/access%' OR LOWER(url) LIKE '%/ui/api%')
AND (
  url IMATCHES '.*(\.\./|\.\.\\|\.\.%2f|%2e%2e%2f|%2e%2e/|%00|/etc/passwd|master\.key).*'
  OR "URL Query" IMATCHES '.*(\.\./|%2e%2e%2f|/etc/passwd|master\.key).*'
)
GROUP BY sourceip, url, urlquery
ORDER BY attempts DESC
LAST 24 HOURS

_sourceCategory=*artifactory* OR _sourceCategory=*proxy*
| parse regex "(?<method>\w+)\s+(?<uri>\S+)\s+HTTP" nodrop
| where uri matches /(?i).*(artifactory|\/access|\/ui\/api).*/
| where uri matches /(?i).*(\.\.\/|\.\.\\|\.\.%2f|%2e%2e%2f|%2e%2e\/|%00|\/etc\/passwd|master\.key).*/
| count as attempts, values(uri) by src_ip
| where attempts >= 1
| sort by attempts

rule cve_2026_66384_artifactory_path_traversal {
  meta:
    author = "argus"
    description = "Detects path traversal exploitation against JFrog Artifactory (CVE-2026-66384)"
    severity = "HIGH"
    cve = "CVE-2026-66384"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.referral_url, `(?i)artifactory`) or
      re.regex($e.target.url, `(?i)(artifactory|/access|/ui/api)`)
    )
    re.regex($e.target.url, `(?i)(\.\./|\.\.\\|\.\.%2f|%2e%2e%2f|%2e%2e/|%00|/etc/passwd|master\.key)`)
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/HttpRequest|NetworkHttp/i
| (Url=/(?i)(artifactory|\/access|\/ui\/api)/ OR HttpPath=/(?i)artifactory/)
| Url=/(?i)(\.\.\/|\.\.\\|\.\.%2f|%2e%2e%2f|%2e%2e\/|%00|\/etc\/passwd|master\.key)/
| groupBy([aid, RemoteAddressIP4], function=([count(as=attempts), collect([Url])]))
| attempts >= 1
| sort(attempts, order=desc)