INFO-Level Findings from Vulnerability Scanners Can Still Pose Real Risks

Introduction

JFrog Artifactory is a universal artifact repository manager that stores and manages binary artifacts used in software development, including libraries, dependencies, and build outputs. It supports multiple package formats and integrates with CI/CD pipelines, enabling teams to manage and distribute software components efficiently and securely.

While Artifactory streamlines DevOps workflows, misconfigurations or outdated versions can expose sensitive artifacts, credentials, and internal resources, creating serious security risks for organizations.

Why You Should Care?

Organisations often rely on automated scanning to assess their external security posture, and INFO-level findings are frequently dismissed without further consideration. This behaviour is reinforced by most security frameworks, which can give security professionals the impression that such findings are safe to ignore. In reality, this misconception can create blind spots that lead to serious security issues and downstream complications.

While Artifactory streamlines DevOps workflows, misconfigurations or outdated versions can expose sensitive artifacts, credentials, and internal resources, creating serious security risks for organizations.

Artifactory Repository Types

Summary: Local repositories hold sensitive internal artifacts, remote repositories cache external dependencies, and virtual repositories unify access. Proper access controls are essential for security.

Vulnerability Overview

Versions of JFrog Artifactory prior to 7.84.3 allowed anonymous access to download artifacts by default. This means that unless anonymous access was explicitly disabled, anyone could retrieve stored files without authentication, potentially exposing sensitive internal resources.

Starting from Artifactory 7.84.3, the anonymous user is removed from the Anything and Any Remote permissions by default, mitigating the risk of unauthorized downloads JFrog Documentation.

Executive Insight: Unauthorized access to internal artifacts can lead to data breaches, exposure of API keys, credentials, or proprietary code, and downstream compromise of services.

Exposure Analysis of JFrog Artifactory Servers

A Shodan search identified 322 JFrog Artifactory instances, of which 116 are publicly accessible, representing a significant security risk if proper controls are not in place.

Insight: The predominance of version 6.x indicates most deployments are recent and benefit from newer features. Older versions (2.x-5.x) may be exposed to unpatched vulnerabilities, highlighting the importance of timely updates and version management.

Artifacts Containing Potentially Sensitive Data

Artifactory repositories may store artifacts containing sensitive information such as database credentials, API keys, and keystore passwords. Development builds are as sensitive as traditional file servers.

Key artifact types include:

Executive Insight: Even seemingly low-risk files (logs, spreadsheets, text) can contain embedded secrets. Public exposure of these repositories could allow attackers to compromise internal services, cloud accounts, and databases.

Understanding the Risk Behind Informational Findings

Network vulnerability scans may report informational findings such as "Artifactory Detect", indicating the presence of Artifactory instances. Although scanners often include a plugin specifically for "JFrog Artifactory Anonymous Deployment Detected", in one particular scan this plugin did not trigger, likely due to detection limitations. These findings are typically classified as INFO and can be easily overlooked.

Security Insight: Even if the anonymous deployment plugin does not trigger, the presence of an Artifactory instance warrants further investigation. Manual verification is recommended to confirm access controls, detect exposed artifacts, and uncover credentials or configuration issues that automated scans may miss.

Methodology for Artifact Assessment

Auditing Artifactory repositories involves crawling, parsing, downloading, and searching for secrets. Since local repositories contain internal builds, they are the primary focus.

Artifactory servers often host numerous repositories, versions, and packages, making it challenging to manually analyze, download, or parse all artifacts. Automated and selective approaches are therefore necessary to efficiently assess potential risks.

To optimize efforts:

• Focus on the latest version of each artifact.
• Prioritize high-risk file types.
• By analysing selectively, the number of artifacts that need to be downloaded and inspected can often be reduced by up to 70%, depending on the repository structure and usage patterns, which reduces bandwidth and processing overhead.

Available Scripts and Functions

These scripts provide a complete workflow for auditing Artifactory servers:

The following is a sample output from running the artifactory_repo_scanner.py script. IP addresses and domain names have been anonymized for security and privacy reasons:

% python3.11 artifactory_repo_scanner.py -h
usage: artifactory_repo_scanner.py [-h] (-u URL | -U URL_LIST) -o OUTPUT [-f] [--type {LOCAL,REMOTE,VIRTUAL}] [--timeout TIMEOUT] [--retries RETRIES] [--list-repos-only] [--repo REPO]
                                   [--threads THREADS] [--fresh] [--resume] [--latest-only] [--use-maven-metadata] [--cache-ttl CACHE_TTL]

JFrog Artifactory recursive file lister (durable resume + latest cache)

options:
  -h, --help            show this help message and exit
  -u URL, --url URL     Base URL of the Artifactory instance
  -U URL_LIST, --url-list URL_LIST
                        File containing list of URLs (one per line)
  -o OUTPUT, --output OUTPUT
                        Output file to save results
  -f, --fingerprint     Only fingerprint the server
  --type {LOCAL,REMOTE,VIRTUAL}
                        Only scan repos of this type
  --timeout TIMEOUT     Request timeout in seconds
  --retries RETRIES     Number of retries for failed requests
  --list-repos-only     List repos but not files
  --repo REPO           Specify a single repo to list files from
  --threads THREADS     Number of concurrent threads for URLs
  --fresh               Start fresh (delete DB)
  --resume              Resume from existing DB (default)
  --latest-only         Only list latest version per artifact
  --use-maven-metadata  When --latest-only, consult maven-metadata.xml for Maven repos (cached in DB)
  --cache-ttl CACHE_TTL
                        Seconds before cached latest_versions entries expire (0 = no expiry)

% python3.11 artifactory_repo_scanner.py -U public_artifactory_servers.txt  --timeout 60 --type LOCAL -o public_repo_files_listing.txt  --threads 15
[+] http://XXX.XXX.XXX.XXX:8080 (Version: 5.8.4)
[+] http://XXX.XXX.XXX.XXX:80 (Version: 6.11.1)
[http://XXX.XXX.XXX.XXX:8080] Found repo: libs-android (Type: LOCAL, Package: unknown) (listed=0)
[http://XXX.XXX.XXX.XXX:8080] Found repo: libs-android-test (Type: LOCAL, Package: unknown) (listed=0)
[http://XXX.XXX.XXX.XXX:8080] Found repo: libs-release-local (Type: LOCAL, Package: unknown) (listed=0)
[http://XXX.XXX.XXX.XXX:8080] Found repo: libs-release-local-maven (Type: LOCAL, Package: unknown) (listed=0)
[*] Scanning repo: libs-android
    [~] libs-android: pending folders=1, files so far=0
[+] https://XXX.XXX.XXX.XXX (Version: 6.8.7)
[https://XXX.XXX.XXX.XXX] Found repo: generic-local (Type: LOCAL, Package: generic) (listed=0)
[https://XXX.XXX.XXX.XXX] Found repo: gradle-dev-local (Type: LOCAL, Package: gradle) (listed=0)
[https://XXX.XXX.XXX.XXX] Found repo: gradle-release-local (Type: LOCAL, Package: gradle) (listed=0)
[https://XXX.XXX.XXX.XXX] Found repo: libs-gtrans-release (Type: LOCAL, Package: maven) (listed=0)
[https://XXX.XXX.XXX.XXX] Found repo: libs-release-local (Type: LOCAL, Package: maven) (listed=0)
[https://XXX.XXX.XXX.XXX] Found repo: libs-snapshot-local (Type: LOCAL, Package: maven) (listed=0)

Conclusion

JFrog Artifactory is critical for modern DevOps workflows, but misconfigurations and outdated versions pose serious security risks.

By combining technical assessment with executive awareness, organizations can:

• Mitigate exposure of sensitive artifacts
• Enforce proper access controls
• Prioritize version updates
• Maintain compliance with security best practices

Call to Action: Regularly audit Artifactory repositories, remove unnecessary anonymous access, and monitor public exposure to safeguard sensitive assets.

Resources