Junglewise Threat Intelligence

CVE-2021-26073: Atlassian Connect Express broken JWT authentication

CVE-2021-26073 · Severity: low · CVSS 3.1 · Published 2022-05-24

Vendors: npm, Atlassian.

Executive brief

Atlassian Connect Express is a framework for building apps that integrate with Jira and Confluence. The framework failed to properly distinguish between two types of authentication tokens, allowing attackers to impersonate legitimate system-to-system requests and trigger app installation or reinstallation events. This could lead to unauthorized app configuration changes or data exposure depending on what actions an app performs during installation.

Technical details

The vulnerability is a broken authentication issue in Atlassian Connect Express (CWE-287: Improper Authentication; CWE-863: Incorrect Authorization). The framework accepts two JWT types: server-to-server JWTs (for lifecycle events) and context JWTs (for UI context in iframes). Versions 3.0.2–6.5.0 fail to enforce proper JWT type validation on lifecycle endpoints (installation, uninstallation, etc.), allowing context JWTs to be accepted where only server-to-server JWTs should be permitted. An attacker with knowledge of the app's shared secret can craft context JWTs to send authenticated requests to lifecycle hooks. The attack vector is network-based and requires low privileges (knowledge of the shared secret). The fix in version 6.6.0 adds strict JWT type validation to lifecycle endpoints. Apps using addon.authenticate() should verify they are not inadvertently accepting context JWTs on sensitive endpoints.

Affected products

  • Atlassian Connect Express 3.0.2 to 6.5.0

Timeline

  • 2021-04-16: disclosed: Vulnerability reported to NVD
  • 2021-04-14: advisory: Atlassian announces vulnerability and breaking API change
  • 2021-05-07: patched: Fix released in version 6.6.0; Spring Boot 2.1.5 also patched
  • 2021-06-07: other: Enforcement deadline for all Marketplace apps to patch

References