PT-2021-16944 · Atlassian · Connect Spring Boot

Published 2021-05-07 · Updated 2025-02-12 · CVE-2021-26077

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Atlassian Connect Spring Boot versions 1.1.0 through 2.1.3 Atlassian Connect Spring Boot versions 2.1.4 through 2.1.5

Description The issue concerns Atlassian Connect Spring Boot, a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. However, Atlassian Connect Spring Boot erroneously accepts context JWTs in lifecycle endpoints, such as installation, where only server-to-server JWTs should be accepted. This allows an attacker to send authenticated re-installation events to an app.

Recommendations For Atlassian Connect Spring Boot versions 1.1.0 through 2.1.3, update to version 2.1.3 or later. For Atlassian Connect Spring Boot versions 2.1.4 through 2.1.5, update to version 2.1.5 or later. As a temporary workaround, consider restricting access to lifecycle endpoints, such as installation, to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2025-11336

CVE-2021-26077

GHSA-2X7V-W2MV-F3RX

Affected Products

Connect Spring Boot

References · 7

• 🔥 https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-allows-bypass-of-app-qsh-verification-via-context-jwts/47072 · Exploit
• https://confluence.atlassian.com/pages/viewpage.action?pageId=1063555147 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26077 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26077 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2x7v-w2mv-f3rx · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11336 · Security Note
• https://t.me/cvenotify/111131 · Telegram Post