# 1️⃣ Create a virtual environment (recommended)
python -m venv venv
source venv/bin/activate   # on Windows: venv\Scripts\activate

# 2️⃣ Install the only dependency we need – requests (with urllib3 security extras)
pip install --upgrade requests
pip install python-dotenv   # for loading .env files (optional but handy)

# 1️⃣ Initialise a new Node project
npm init -y

# 2️⃣ Install dependencies
npm install axios dotenv   # axios for HTTP, dotenv for env vars
# If you prefer TypeScript:
npm install --save-dev typescript @types/node ts-node
npx tsc --init   # creates a basic tsconfig.json

#!/usr/bin/env python3
"""
ICARAX Blog: Defensive script for CVE‑2024‑XXXXX (JFrog Artifactory).

Features:
  - Retrieve Artifactory version
  - Check anonymous access flag
  - List local repositories
  - (Optional) Trigger an Xray scan on a repo
"""

import os
import sys
import json
import logging
from typing import Any, Dict, List

import requests
from requests.auth import HTTPBasicAuth
from dotenv import load_dotenv

# ----------------------------------------------------------------------
# Load environment variables from .env (if present)
# ----------------------------------------------------------------------
load_dotenv()  # expects ARTIFACTORY_URL, ARTIFACTORY_USER, ARTIFACTORY_TOKEN

# ----------------------------------------------------------------------
# Configuration (read from env, with sensible defaults where possible)
# ----------------------------------------------------------------------
ARTIFACTORY_URL = os.getenv("ARTIFACTORY_URL", "").rstrip("/")
ARTIFACTORY_USER = os.getenv("ARTIFACTORY_USER")
ARTIFACTORY_TOKEN = os.getenv("ARTIFACTORY_TOKEN")  # API key or password
VERIFY_SSL = os.getenv("ARTIFACTORY_VERIFY_SSL", "true").lower() == "true"
TIMEOUT = int(os.getenv("ARTIFACTORY_TIMEOUT", "15"))

if not ARTIFACTORY_URL or not (ARTIFACTORY_USER and ARTIFACTORY_TOKEN):
    sys.exit(
        "❌ Missing required environment variables: "
        "ARTIFACTORY_URL, ARTIFACTORY_USER, ARTIFACTORY_TOKEN"
    )

# ----------------------------------------------------------------------
# Logging setup
# ----------------------------------------------------------------------
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s %(levelname)s %(name)s - %(message)s",
)
log = logging.getLogger("artifactory_hardening")

# ----------------------------------------------------------------------
# Helper: generic GET request with error handling
# ----------------------------------------------------------------------
def _get(endpoint: str, params: Dict[str, Any] | None = None) -> Dict[str, Any]:
    url = f"{ARTIFACTORY_URL}{endpoint}"
    auth = HTTPBasicAuth(ARTIFACTORY_USER, ARTIFACTORY_TOKEN)
    try:
        resp = requests.get(
            url,
            auth=auth,
            params=params,
            timeout=TIMEOUT,
            verify=VERIFY_SSL,
        )
        resp.raise_for_status()
        return resp.json()
    except requests.RequestException as exc:
        log.error("GET %s failed: %s", endpoint, exc)
        raise

# ----------------------------------------------------------------------
# 1️⃣ Fetch Artifactory version
# ----------------------------------------------------------------------
def get_version() -> str:
    data = _get("/api/system/version")
    version_str = data.get("version", "unknown")
    log.info("Artifactory version: %s", version_str)
    return version_str

# ----------------------------------------------------------------------
# 2️⃣ Check anonymous access status
# ----------------------------------------------------------------------
def get_anonymous_access() -> bool:
    """
    Returns True if anonymous access is enabled.
    Endpoint: /api/security/anonymouse (note spelling!)
    """
    data = _get("/api/security/anonymouse")
    enabled = data.get("enabled", False)
    log.info("Anonymous access enabled: %s", enabled)
    return enabled

# ----------------------------------------------------------------------
# 3️⃣ List local repositories (requires at least read permission)
# ----------------------------------------------------------------------
def list_local_repos() -> List[str]:
    data = _get("/api/repositories?type=local")
    repos = [r.get("key") for r in data if isinstance(r, dict) and r.get("key")]
    log.info("Found %d local repositories", len(repos))
    for r in repos:
        log.debug("  - %s", r)
    return repos

# ----------------------------------------------------------------------
# 4️⃣ (Optional) Trigger an Xray scan on a repo
# ----------------------------------------------------------------------
def trigger_xray_scan(repo_key: str) -> None:
    """
    Requires JFrog Xray to be installed and linked.
    Endpoint: POST /api/v1/scan (Xray) – note the different base path.
    """
    # Xray uses the same base URL but a different context path
    xray_url = f"{ARTIFACTORY_URL}/xray"
    scan_endpoint = f"{xray_url}/api/v1/scan"
    payload = {
        "repo": repo_key,
        "scan_type": "repository",
    }
    auth = HTTPBasicAuth(ARTIFACTORY_USER, ARTIFACTORY_TOKEN)
    try:
        resp = requests.post(
            scan_endpoint,
            json=payload,
            auth=auth,
            timeout=TIMEOUT,
            verify=VERIFY_SSL,
        )
        resp.raise_for_status()
        log.info("Xray scan triggered for repo %s: %s", repo_key, resp.json())
    except requests.RequestException as exc:
        log.error("Failed to trigger Xray scan for %s: %s", repo_key, exc)
        raise

# ----------------------------------------------------------------------
# Main orchestration
# ----------------------------------------------------------------------
def main() -> None:
    try:
        version = get_version()
        # Example: you could compare against a known vulnerable range here
        # if version < "7.XX.YY": log.warning("Potentially vulnerable!")

        anon_enabled = get_anonymous_access()
        if anon_enabled:
            log.warning(
                "⚠️ Anonymous access is ENABLED – consider disabling it immediately."
            )

        repos = list_local_repos()
        # Example: scan the first repo if Xray is available
        if repos and os.getenv("ENABLE_XRAY_SCAN", "false").lower() == "true":
            trigger_xray_scan(repos[0])

    except Exception as exc:  # pragma: no cover – defensive top-level catch
        log.exception("Unhandled error: %s", exc)
        sys.exit(1)

if __name__ == "__main__":
    main()

# Create a .env file (see Step 4) or export variables directly
export ARTIFACTORY_URL="https://artifactory.example.com"
export ARTIFACTORY_USER="admin"
export ARTIFACTORY_TOKEN="YOUR_API_KEY"
# Optional: enable Xray scan demo
export ENABLE_XRAY_SCAN="true"

python artifactory_hardening.py

/**
 * ICARAX Blog: Defensive Node.js/TS script for CVE‑2024‑XXXXX (JFrog Artifactory).
 *
 * Demonstrates:
 *   - Version check
 *   - Anonymous access flag
 *   - List local repos
 *   - Optional Xray scan trigger
 *
 * Requires Node.js ≥18 and the packages installed in Step 2.
 */

import axios, { AxiosInstance } from "axios";
import dotenv from "dotenv";

// ----------------------------------------------------------------------
// Load .env (if present)
// ----------------------------------------------------------------------
dotenv.config();

// ----------------------------------------------------------------------
// Configuration
// ----------------------------------------------------------------------
const ARTIFACTORY_URL = process.env.ARTIFACTORY_URL?.replace(/\/+$/, "");
const ARTIFACTORY_USER = process.env.ARTIFACTORY_USER;
const ARTIFACTORY_TOKEN = process.env.ARTIFACTORY_TOKEN;
const VERIFY_SSL = process.env.ARTIFACTORY_VERIFY_SSL?.toLowerCase() !== "false";
const TIMEOUT = Number(process.env.ARTIFACTORY_TIMEOUT) || 15;

if (!ARTIFACTORY_URL || !ARTIFACTORY_USER || !ARTIFACTORY_TOKEN) {
  console.error(
    "❌ Missing required env vars: ARTIFACTORY_URL, ARTIFACTORY_USER, ARTIFACTORY_TOKEN"
  );
  process.exit(1);
}

// ----------------------------------------------------------------------
// Create an axios instance with basic auth
// ----------------------------------------------------------------------
const api: AxiosInstance = axios.create({
  baseURL: ARTIFACTORY_URL,
  timeout: TIMEOUT,
  httpsAgent: undefined, // let axios handle SSL; Node will respect NODE_TLS_REJECT_UNAUTHORIZED
  validateStatus: (status) => status < 500, // we treat 4xx as resolvable errors
});

// Apply basic auth to every request
api.interceptors.request.use((config) => {
  config.auth = {
    username: ARTIFACTORY_USER,
    password: ARTIFACTORY_TOKEN,
  };
  return config;
});

// ----------------------------------------------------------------------
// Helper wrapper for consistent error handling
// ----------------------------------------------------------------------
async function safeGet<T>(url: string): Promise<T> {
  try {
    const { data } = await api.get<T>(url, { validateStatus: (s) => s < 400 });
    if (data === undefined) throw new Error("Empty response");
    return data;
  } catch (err: any) {
    if (err.response) {
      console.error(
        `❌ GET ${url} failed – ${err.response.status}: ${err.response.data}`
      );
    } else {
      console.error(`❌ GET ${url} failed – ${err.message}`);
    }
    throw err;
  }
}

// ----------------------------------------------------------------------
// 1️⃣ Get Artifactory version
// ----------------------------------------------------------------------
async function getVersion(): Promise<string> {
  const resp = await safeGet<{ version: string }>("/api/system/version");
  console.log(`🔖 Artifactory version: ${resp.version}`);
  return resp.version;
}

// ----------------------------------------------------------------------
// 2️⃣ Check anonymous access
// ----------------------------------------------------------------------
async function getAnonymousAccess(): Promise<boolean> {
  // Note the endpoint spelling: anonymouse (not anonymous)
  const resp = await safeGet<{ enabled: boolean }>("/api/security/anonymouse");
  console.log(`🕵️‍♂️ Anonymous access enabled: ${resp.enabled}`);
  return resp.enabled;
}

// ----------------------------------------------------------------------
// 3️⃣ List local repositories
// ----------------------------------------------------------------------
async function listLocalRepos(): Promise<string[]> {
  const resp = await safeGet<any[]>("/api/repositories?type=local");
  const keys = resp
    .filter((r): r is { key: string } => typeof r?.key === "string")
    .map((r) => r.key);
  console.log(`📦 Found ${keys.length} local repositories`);
  keys.forEach((k) => console.log(`   - ${k}`));
  return keys;
}

// ----------------------------------------------------------------------
// 4️⃣ (Optional) Trigger Xray scan on a repo
// ----------------------------------------------------------------------
async function triggerXrayScan(repoKey: string): Promise<void> {
  const xrayBase = `${ARTIFACTORY_URL}/xray`;
  const xrayApi = axios.create({
    baseURL: xrayBase,
    timeout: TIMEOUT,
    httpsAgent: undefined,
  });
  xrayApi.interceptors.request.use((cfg) => {
    cfg.auth = { username: ARTIFACTORY_USER, password: ARTIFACTORY_TOKEN };
    return cfg;
  });

  try {
    const { data } = await xrayApi.post(
      "/api/v1/scan",
      { repo: repoKey, scan_type: "repository" },
      { validateStatus: (s) => s < 400 }
    );
    console.log(`🚀 Xray scan triggered for ${repoKey}:`, data);
  } catch (err: any) {
    if (err.response) {
      console.error(
        `❌ Xray scan failed – ${err.response.status}: ${err.response.data}`
      );
    } else {
      console.error(`❌ Xray scan failed – ${err.message}`);
    }
    throw err;
  }
}

// ----------------------------------------------------------------------
// Main driver
// ----------------------------------------------------------------------
(async () => {
  try {
    const version = await getVersion();
    // Example vulnerability check – replace with actual vulnerable range if known
    // const isVulnerable = semver.lt(version, "7.XX.YY");
    // if (isVulnerable) console.warn("⚠️ Version may be vulnerable!");

    const anon = await getAnonymousAccess();
    if (anon) {
      console.warn(
        "⚠️ Anonymous access is ENABLED – disable it immediately via UI or API."
      );
    }

    const repos = await listLocalRepos();
    if (
      repos.length > 0 &&
      process.env.ENABLE_XRAY_SCAN?.toLowerCase() === "true"
    ) {
      await triggerXrayScan(repos[0]);
    }
  } catch (e) {
    console.error("💥 Unexpected error:", e);
    process.exit(1);
  }
})();

# If you saved as .ts
npx ts-node artifactoryHardening.ts

# Or compile first
npx tsc
node dist/artifactoryHardening.js

# .env – Example (replace with your own values)
ARTIFACTORY_URL=https://artifactory.example.com
ARTIFACTORY_USER=admin
ARTIFACTORY_TOKEN=YOUR_API_KEY_OR_PASSWORD
# Optional toggles
ARTIFACTORY_VERIFY_SSL=true          # set false only for self‑signed certs in dev
ARTIFACTORY_TIMEOUT=20               # seconds
ENABLE_XRAY_SCAN=false               # set true to demo an Xray scan trigger