One-Click Exploit Could Have Let Attackers Hijack Any Atlassian Account

Cybersecurity researchers on Wednesday disclosed critical flaws
in the Atlassian project and software development platform that
could be exploited to take over an account and control some of the
apps connected through its single sign-on (SSO^[1]) capability.

“With just one click, an attacker could have used the flaws to
get access to Atlassian’s publish Jira system and get sensitive
information, such as security issues on Atlassian cloud, Bitbucket
and on premise products,” Check Point Research said^[2]
in an analysis shared with The Hacker News.

After the issues were reported to Atlassian on Jan. 8, 2021, the
Australian company deployed a fix as part of its updates^[3]
rolled out on May 18^[4]. The sub-domains
affected by the flaws include –

• jira.atlassian.com
• confluence.atlassian.com
• getsupport.atlassian.com
• partners.atlassian.com
• developer.atlassian.com
• support.atlassian.com
• training.atlassian.com

Successful exploitation of these flaws could result in a
supply-chain attack wherein an adversary can take over an account,
using it to perform unauthorized actions on behalf of the victim,
edit Confluence pages, access Jira tickets, and even inject
malicious implants to stage further attacks down the line.

The weaknesses hinge on the fact that Atlassian uses SSO to
ensure seamless navigation between the aforementioned domains, thus
creating a potential attack scenario that involves injecting
malicious code into the platform using XSS^[5]
and CSRF^[6], followed by leveraging
a session fixation^[7]
flaw to hijack a valid user session and take control of an
account.

In other words, an attacker can trick a user into clicking on a
specially-crafted Atlassian link in order to execute a malicious
payload that steals the user’s session, which can then be used by
the bad actor to log in to the victim’s account and obtain
sensitive information.

What’s more, armed with the Jira account, the attacker can
proceed to gain control of a Bitbucket account by opening a Jira
ticket embedded with a malicious link to a rogue website that, when
clicked from an auto-generated email message^[8], could be used to pilfer
the credentials, effectively granting them permissions to access or
alter source code, make the repository public, or even insert
backdoors.

“Supply chain attacks have piqued our interest all year, ever
since the SolarWinds incident^[9]. The platforms from
Atlassian are central to an organization’s workflow,” said Oded
Vanunu, head of products vulnerabilities research at Check Point.
“An incredible amount of supply chain information flows through
these applications, as well as engineering and project
management.”

“In a world where distributed workforces increasingly depend on
remote technologies, it’s imperative to ensure these technologies
have the best defenses against malicious data extraction,” Vanunu
added.