Atlassian data leak PART 1
Security Flaw in Atlassian Products (Jira, Confluence,Trello, BitBucket) Affecting Multiple Companies
We discovered that for Atlassian products (Jira, Confluence, and BitBucket), cookies are not invalidated, even if the password is changed, with 2FA (Two-factor Authentication) enabled, as the cookie validity is 30 days. They only expire when the user logs out, or after 30 days.
On 6th Dec 2022, CloudSEK disclosed a cyber-attack directed at the company. During the course of an investigation into the root cause of the incident, the internal investigation team identified that the threat actor gained access to a CloudSEK employee’s Jira account, using Jira session cookies present in stealer logs being sold on the darkweb.
CloudSEK researchers have identified that this flaw can take over hundreds of companies’ Jira accounts. Our records show over 1,282,859 compromised computers and 16,201 Jira cookies for sale on dark web marketplaces. And just in the last 30 days, over 2,937 compromised computers and 246 Jira credentials were made available. In the past 90 days, we have observed at least one compromised computer from a Fortune 1000 company. This is just considering their primary domains, not their subsidiaries.
CloudSEK is releasing a free tool that lets companies check if their compromised computers and Jira accounts are being advertised on dark web marketplaces.
With over 10 million users across 180,000 companies, including 83% of Fortune 500 companies Atlassian products are widely used across the globe. And threat actors are actively exploiting this flaw to compromise enterprise Jira accounts.
This is a known issue, and most companies do not consider it to be within the scope of security reporting, because to use this and get into systems, tokens are required. There are other vulnerabilities like XSS which can be used to get tokens and they are in scope for security reporting. However, the use of social engineering is out of scope for Bug Bounty engagements and in this case, exploiting the malware and dumping information like cookies requires social engineering.
However, it is no longer very difficult for threat actors to get their hands on these tokens. With the rise in device compromise campaigns, breaches, and password leaks, cookie theft has become commonplace. And cookies are available for sale and one can simply search for a company, buy their logs, find relevant tokens to gain access to their internal systems.
In the case of Atlassian products, only one JSON web token (JWT) is required to hijack a session i.e. cloud.session.token.
Atlassian JWT (JSON Web Token) tokens have the email address embedded in the cookie. Hence, it is easy to determine which user the cookie belongs to. It seems that this bug is fixed now by Atlassian very silently after we reported it and without acknowledging it.
Story published by CloudSEk
https://tinyurl.com/4a3cb5fh