CVE-2021-26077: Improper Authentication in Atlassian Connect Spring Boot
Summary
CVE-2021-26077: Improper Authentication in Atlassian Connect Spring Boot. Affects com.atlassian.connect:atlassian-connect-spring-boot across 2 version ranges.
>= 1.1.0, < 2.1.3
>= 2.1.4, < 2.1.5
Fixed in 2.1.3 or 2.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Atlassian Connect Spring Boot (ACSB) is a Java Spring Boot package used for building Atlassian Connect apps. It facilitates authentication between Atlassian products and the Atlassian Connect Spring Boot app through server-to-server JWT or context JWT. This vulnerability affects ACSB versions 1.1.0 to 2.1.3 and 2.1.4 to 2.1.5. The issue arises from the acceptance of context JWTs in lifecycle endpoints, such as installation, where only server-to-server JWTs should be accepted. This allows an attacker to send authenticated re-installation events to an app.
Vulnerability Detail
The vulnerability in Atlassian Connect Spring Boot allows an attacker to exploit the acceptance of context JWTs in lifecycle endpoints. By sending authenticated re-installation events to an app, the attacker can bypass proper authentication and gain unauthorized access. This can lead to various security risks, including unauthorized data access, privilege escalation, and potential compromise of the entire system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.1.0, < 2.1.32.1.3 -
>= 2.1.4, < 2.1.52.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fixes by upgrading to the patched versions of Atlassian Connect Spring Boot.
Conclusion
In conclusion, the vulnerability in Atlassian Connect Spring Boot allows for improper authentication, enabling attackers to bypass authentication and gain unauthorized access. It is crucial to upgrade to the patched versions of Atlassian Connect Spring Boot to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.atlassian.connect:atlassian-connect-spring-boot →
FAQ
Atlassian Connect Spring Boot is a Java Spring Boot package used for building Atlassian Connect apps. It facilitates authentication between Atlassian products and the Atlassian Connect Spring Boot app.
This vulnerability allows an attacker to bypass authentication and gain unauthorized access to an app. It can lead to unauthorized data access, privilege escalation, and potential compromise of the entire system.
Versions 1.1.0 to 2.1.3 and 2.1.4 to 2.1.5 of Atlassian Connect Spring Boot are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Atlassian Connect Spring Boot to version 2.1.3 if using versions 1.1.0 to 2.1.3, or upgrade to version 2.1.5 if using versions 2.1.4 to 2.1.5.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fixes by upgrading to the patched versions of Atlassian Connect Spring Boot.
