Atlassian Bitbucket, Confluence, Jira and five other products (all versions)
Atlassian makes widely used business collaboration and development tools — Jira for project tracking, Confluence for team wikis, Bitbucket for code storage, and several others used by software teams worldwide.
Root Cause
The server fails to verify whether a requesting user has permission to access a file before returning it. If the attacker already knows the file path — and for common configurations, paths are predictable — there is nothing stopping retrieval. Organisations using Crowd for single sign-on are at heightened risk because authentication credentials are stored in plaintext at a known location.
Attack Vector
An unauthenticated attacker sends a crafted HTTP request pointing at a known file path. The server returns the file. No login required. With SSO credentials in hand, the attacker can then create admin accounts and move freely through the environment.
Detection Notes
Look for unusual GET requests to configuration or credential file paths in your web server logs. Monitor for new admin account creation outside normal provisioning windows. Flag external access to Crowd endpoints.
Recommended Actions
- Patch all affected products immediately using the fixed versions listed in the Atlassian advisory.
- If patching is not immediately possible, block external internet access to your Atlassian instances entirely.
- Deploy WAF (web application firewall) rules per Atlassian's guidance as a temporary mitigation.