CVE-2021-26077 Improper Authentication in Atlassian Connect Spring Boot
An attacker can bypass authentication in Atlassian Connect Spring Boot by sending context JWTs to lifecycle endpoints, allowing unauthorized re-installation events.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-26077?
CVE-2021-26077 is a critical authentication bypass vulnerability in Atlassian Connect Spring Boot (ACSB), published on 9 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
Weakness: CWE-287
Which versions are affected by CVE-2021-26077?
4 open source packages ship an affected version, including com.atlassian.connect:atlassian-connect-spring-boot. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.atlassian.connect:atlassian-connect-spring-boot Maven | From 1.1.0 | 2.1.3 |
com.atlassian.connect:atlassian-connect-spring-boot Maven | From 1.1.0 | 2.1.3 |
com.atlassian.connect:atlassian-connect-spring-boot Maven | From 2.1.4 | 2.1.5 |
com.atlassian.connect:atlassian-connect-spring-boot Maven | From 2.1.4 | 2.1.5 |
Products include Atlassian Connect Spring Boot.
How do I fix CVE-2021-26077?
Upgrade com.atlassian.connect:atlassian-connect-spring-boot to a fixed version for your release line: 2.1.3 or 2.1.5.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-26077 being exploited?
There is no known exploitation of CVE-2021-26077 in the wild and no public exploit code.
Other vulnerabilities in Atlassian Connect Spring Boot (ACSB)
Sources
Also known as GHSA-2x7v-w2mv-f3rx.