Two Artifactory flaws poisoned metadata, not artifacts, and that was enough to break a shared cache

The Helm case is worth reading slowly, because the defect is not the header itself, it is a disagreement between two keys. Oligo found that the full attacker-controlled URL was written into the generated metadata, while only its 32-bit Java hash decided where that metadata got cached ^[7]. Construct a second URL with the same hash and it lands in the same cache slot, so the next user to ask for the index is served the attacker's copy ^[7]. Virtual repositories are what make that cross-user rather than self-inflicted ^[8]. A 32-bit space holds 4,294,967,296 values ^[1], and I would not describe searching that as an obstacle.

npm did not fall the same way, and the reason is the interesting part: it had a separate cache guard, but the guard checked two other override headers and not X-Orig-Client-Uri [c8b]. That is a list of headers somebody remembered, not a rule about which headers may survive the routing boundary. The same assumption appears in JFrog's own recommended nginx configuration, where X-Forwarded-Proto could influence generated absolute URLs once a caching reverse proxy sat in the path ^[9]. Product and guidance agreed on the wrong thing, which is that a header arriving from an external client says something reliable about routing ^[6].

The second bug is quieter and reads worse. Artifactory's authorization path treated .jfrog/ as trusted, and the REST COPY and MOVE APIs plus WebDAV MKCOL could reach it without the protection applied to a normal upload ^[10]. Oligo lists what consumes those files: npm signing keys, OCI referrers, Docker indexes and Ansible indexes ^[11]. An authenticated user with suitable repository access could place or create content there ^[12], which is a write into the directory that tells package handlers which key to believe. The 3.4-point CVSS gap between the two findings ^[2] is scoring the access required, not the trust reached.

A registry mirror earns its place in most threat models by being infrastructure you own, and what you own is a store of bytes with digests attached. The part that decides which bytes a client fetches, and whether it trusts the signature on them, was on an unpatched instance writable by someone who could not write a package ^[1]. Provenance verified at the consumer, against a digest recorded somewhere other than the registry, survives both of these findings. "It came from our Artifactory" does not.