Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detect Jfrog Artifactory tokens #3011

Open
arjunharidasp opened this issue Jun 26, 2024 · 1 comment
Open

Detect Jfrog Artifactory tokens #3011

arjunharidasp opened this issue Jun 26, 2024 · 1 comment

Comments

@arjunharidasp
Copy link

arjunharidasp commented Jun 26, 2024

Please review the Community Note before submitting

Description

In Trufflehog detectors, we see artifactory is mentioned.
However when tested with Jfrog artifactory token, its not getting detected as a secret.

Jfrog artifactory patterns

curl -username: -T <PATH_TO_FILE> "artifactory url/artifactname/<TARGET_FILE_PATH>"

curl -uusername: -L -O "artifactory url/artifactname/<TARGET_FILE_PATH>"

wget --header='X-JFrog-Art-Api: token' "artifactory url/artifactname/<TARGET_FILE_PATH>"

curl -v -H "X-JFrog-Art-Api: token"-T <PATH_TO_FILE> "artifactory url/artifactname/<TARGET_FILE_PATH>"

curl -H "X-JFrog-Art-Api:apitoken" -O " "artifactory url/artifactname/<TARGET_FILE_PATH>"

Examples
text: |
export ARTIFACTORY_URL=http://localhost:8081/artifactory
export ARTIFACTORY_TOKEN=AKCp5bueTFpfypEqQbGJPp7eHFi28fBivfWczrjbPb9erDff9LbXZbj6UsRExVXA8asWGc8fM
apikey: AKCp5bueTFpfypEqQbGJPp7eHFi28fBivfWczrjbPb9erDff9LbXZbj6UsRExVXA8asWGc8fM

Preferred Solution

Jfrog artifactory api keys or tokens are detected as secrets

@arjunharidasp arjunharidasp changed the title Detect Artifactory tokens Detect Jfrog Artifactory tokens Jun 26, 2024
@CyberArkCH3
Copy link

This bug is still outstanding

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

No branches or pull requests

2 participants