Atlassian Jira/Confluence: Cross-base Rename Vulnerability via Improper Object Authorization

Vulnerability Summary Vulnerability Overview Vulnerability Title: Cross-base rename via incorrect object authorization in PATCH /api/base/baseId/node/folder/folderId Vulnerability Type: Cross-base rename Root Cause: Incorrect object authorization allows attackers to rename a folder from one Base to another by forging requests. Impact Description: - Attackers can move folders from one Base to another without authorization. - May lead to data leakage, privilege escalation, or data corruption. - This vulnerability has been exploited, resulting in actual data leakage incidents. Scope of Impact Affected Versions: - 2020-10-12T14:45 - 2020-10-12T12:45 - 52E.3331 Affected Components: - Folder PATCH API - Object authorization mechanism Affected Users: - All users of Atlassian products (e.g., Jira, Confluence) running affected versions. - Particularly those who have enabled multi-base functionality. Remediation Fixed Versions: - Versions released after 2020-10-12T12:45 - Versions after 52E.3331 Remediation Measures: - Fixed object authorization logic to ensure only authorized users can perform cross-base rename operations. - Enhanced API request validation mechanisms to prevent unauthorized requests. Recommended Actions: - Immediately upgrade to the fixed version. - Check for any anomalous rename operations, especially cross-base renames. - Review logs to confirm whether any unauthorized rename operations occurred. POC Code or Exploit Code Note: The code above is for illustrative purposes only. Actual exploitation requires specific authorization conditions and environment configurations. Do not attempt to exploit this vulnerability without proper authorization.

Goal Reached Thanks to every supporter — we hit 100%!

Atlassian Jira/Confluence: Cross-base Rename Vulnerability via Improper Object Authorization

More from this source