JFrog Security Research

Cutting Edge Security Research to Protect the Modern Software Supply Chain

Our dedicated team of security engineers and researchers are committed to advancing software security through discovery, analysis, and exposure of new vulnerabilities and attack methods.

Follow JFrog Security twitter
Latest CVE Analyses
27 Sep 2024
12 Aug 2024
CVE-2024-38428 Wget Vulnerability: All you need to know
24 Jan 2024
CVE-2023-43787 Vulns in libX11: All You Need To Know
Software Vulnerabilities

Latest from JFrog's Security Blog

Machine Learning Bug Bonanza – Exploiting ML Services
Machine Learning Bug Bonanza – Exploiting ML Services

Shachar Menashe, JFrog Senior Director Security Research | Or Peles, JFrog Vulnerability Research Team Leader | Natan Nehorai, JFrog Application Security Researcher | Ori Hollander, JFrog Security Researcher

JFrog’s security research team continuously monitors open-source software registries, proactively identifying and addressing potential malware and vulnerability threats to foster a secure and reliable ecosystem for open-source software development and deployment. In our previous research on MLOps we noted the immaturity of the Machine Learning (ML) field often results in a higher amount of discovered...
Reading Time
18 min read
Published on November 4, 2024
Unix CUPS Unauthenticated RCE Zero-Day Vulnerabilities (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177): All you need to know
Unix CUPS Unauthenticated RCE Zero-Day Vulnerabilities (CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, CVE-2024-47177): All you need to know

Shachar Menashe, JFrog Senior Director Security Research | Yair Mizrahi, JFrog Security Research Team Leader

On September 23rd, Twitter user Simone Margaritelli (@evilsocket) announced that he has discovered and privately disclosed a CVSS 9.9 GNU/Linux unauthenticated RCE, which affects almost all Linux distributions, and that the public disclosure will happen on September 30th, Due to a suspected leak in the disclosure process, @evilsocket decided to advance the disclosure, and on...
Reading Time
7 min read
Published on September 27, 2024
Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk
Revival Hijack – PyPI hijack technique exploited in the wild, puts 22K packages at risk

Andrey Polkovnichenko, JFrog Security Researcher | Brian Moussalli, JFrog Malware Research Team Leader

JFrog's security research team continuously monitors open-source software registries, proactively identifying and addressing potential malware and vulnerability threats to foster a secure and reliable ecosystem for open-source software development and deployment. This blog details a PyPI supply chain attack technique the JFrog research team discovered had been recently exploited in the wild. This attack technique...
Reading Time
18 min read
Published on September 4, 2024
Software Vulnerabilities

Latest vulnerabilities discovered by the team

JFrog security researchers and engineers collaborate to create advanced vulnerability scanners, built on a deep understanding of attackers' techniques.

We use our automated scanners to help the community by continually identifying new vulnerabilities in publicly available software packages and disclosing them.

Malicious Packages

Latest malicious packages disclosed by the team

Given the widespread use of open-source software (OSS) packages in modern application development, public OSS repositories have become a popular target for supply chain attacks.

To help foster a secure environment for developers, the JFrog Security research team continuously monitors popular repositories with our automated tooling, and reports malicious packages discovered to repository maintainers and the wider community.

  • twitter
    flophttp
    pypi•<1k total downloads
    Published on 1 Sep, 2024
  • twitter
    invokehttp
    pypi•<1k total downloads
    Published on 29 Aug, 2024
  • twitter
    cargo-hub-ui-api
    npm•<1k total downloads
    Published on 11 Aug, 2024
  • twitter
    cargo-hub-ui-api-internal
    npm•<1k total downloads
    Published on 11 Aug, 2024
  • twitter
    ptmpl
    pypi•<1k total downloads
    Published on 16 Jul, 2024
OSS Tools

Latest security OSS tools released by the team

When new software security threats arise, in many cases the time to respond is of the essence.
The JFrog Security research team supports the community with a range of OSS tools to identify such threats in your software quickly.

  • CVE-2024-3094-detector
    Checks if the local machine is vulnerable to CVE-2024-3094 and currently affected by CVE-2024-3094
    Get it on GitHub
    Published on 31 Mar, 2024
  • openssl_req_client_cert
    Determines whether client authentication is required by the SSL server, in which case servers based on OpenSSL 3.0.0..3.0.6 will be vulnerable to CVE-2022-3602 & CVE-2022-3786
    Get it on GitHub
    Published on 2 Nov, 2022
  • scan_vulnerable_openssl_code
    Finds binaries with a statically-linked version of OpenSSL. Specifically the tool diferentiates between OpenSSL 3.0.0-3.0.6 (vulnerable versions) and 3.0.7 (fixed version).
    Get it on GitHub
    Published on 2 Nov, 2022
  • text_4_shell_patch
    Looks for the vulnerable ScriptStringLookup class in the commons-text jar given and disables the lookup() function, effectively patching the vulnerability The tool can also patch (disable) the vulnerable DnsStringLookup and URLStringLookup funtionalities
    Get it on GitHub
    Published on 24 Oct, 2022
  • scan_commons_text_versions
    Recursively searches for the class code of StringLookupFactory (regardless of containing .jar file names and content of pom.xml files), and attempts to fingerprint the versions of the objects to report whether the included version of commons-text is vulnerable.
    Get it on GitHub
    Published on 18 Oct, 2022
The JFrog Detection Edge

The JFrog Detection Edge

The JFrog Security research team is part of the group behind JFrog Xray, enhancing its unique vulnerability database and utilizing patented technology to quickly detect unknown security issues in both open source and proprietary code.

The JFrog Detection Edge

Report Vulnerabilities Discovered in JFrog Products

The security and quality of our code is a top priority for JFrog. If you find a vulnerability or any other type of security issue in one of our products, please report it to us immediately. Security researchers may be able to participate in a bug bounty program and earn rewards for their findings.

Learn more about how to report a vulnerability >

Powered By jfrog.com

Powered By
jfrog.com