PT-2021-16941 · Atlassian · Connect Spring Boot

Published 2021-04-16 · Updated 2025-02-12 · CVE-2021-26074

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Atlassian Connect Spring Boot versions 1.1.0 through 2.1.2

Description The issue concerns broken authentication in Atlassian Connect Spring Boot, a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the app occurs via a server-to-server JWT or a context JWT. However, versions of Atlassian Connect Spring Boot from 1.1.0 before 2.1.3 incorrectly accept context JWTs in lifecycle endpoints, such as installation, where only server-to-server JWTs should be accepted. This allows an attacker to send authenticated re-installation events to an app.

Recommendations For Atlassian Connect Spring Boot versions 1.1.0 through 2.1.2, update to version 2.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to lifecycle endpoints, such as installation, to minimize the risk of exploitation.

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

CVE-2021-26074

GHSA-CPCR-74Q9-74GP

Affected Products

Connect Spring Boot

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-26074 · Security Note
• https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072 · Vendor Advisory
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1051986106 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpcr-74q9-74gp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-26074 · Vendor Advisory
• https://t.me/cvenotify/13323 · Telegram Post
• https://t.me/cvenotify/13383 · Telegram Post
• https://t.me/cvenotify/111128 · Telegram Post