Atllasian Product

Hi, so today we will be discussing Security Flaw in Atlassian Products (Jira,
Confluence, Trello, BitBucket) Affecting Multiple Companies.

Recently on 6th Dec 2022, CloudSEK disclosed a cyber attack directed at the
company.During the course, the internal investigation team identified that the
threat actor also called a malicious actor or bad actor gained access to a CloudSEK
employee’s Jira account, using Jira session cookies present in stealer logs like
usernames and passwords or other sensitive informtion and then send this
information to another system either via email or over a network which is then
being sold on the darkweb.
Following further investigation, it was found that for Atlassian products like
Jira, Confluence, and BitBucket), cookies are exposed, even if the password is
changed, with (Two-factor Authentication) enabled, as the validation period of
cookie is 30 days,They only expire when the user logs out, or after 30 days of
interval. Hence, threat actors can restore Jira, Confluence, Trello, or BitBucket
sessions, using stolen cookies, even if they don’t have access to MFA OTP/ PIN.
This is a well-known problem, and since tokens are needed to use it and access
systems, most businesses do not see it as being under the purview of security
reporting. Other flaws, such as XSS(Cross-site Scripting), that can be leveraged to
get tokens fall under the purview of security reporting. In this instance, however,
social engineering is needed to exploit the virus and spill information like
cookies, which is outside the scope of Bug Bounty operations.
Threat actors or malicious actor may now easily obtain these tokens, however it is
still not that simple. Cookie theft is now frequent due to the increase in device
hack efforts, breaches/breakdowns, and password leaks. Additionally, cookies can be
purchased, and it's easy to discover a business, purchase its logs, and locate the
necessary tokens to obtain access to its internal systems.
Researchers from CloudSEK have found that this vulnerability allows for the
takeover of Jira accounts at hundreds of businesses. According to their data, there
are 16,201 Jira cookies for sale on dark web marketplaces, and there are over
1,282,859 compromised PCs. Additionally, approximately 2,937 hacked PCs and 246
Jira credentials were made public just in the past 30 days. They have detected at
least one infected machine from a Fortune 1000 organisation in the last ninety
days. This only takes into account their main websites i.e,their primary domain not
their affiliates or subsidiaries.
CloudSEK has also released a free tool that lets companies check if their
compromised computers and Jira accounts are being advertised on dark web
marketplaces.
In the case of Atlassian products, only one JSON web token (JWT) is required to
hijack a session i.e. cloud.session.token. Atlassian JWT tokens have the email
address embedded in the cookie. Hence, it is easy to determine which user the
cookie belongs to.This bug has been resolved by them few days before after this
issue came into the picture by cloudSEK. Atlassian added a redirect URL parameter
in the response to change the password request now. This will invalidate the
current session and will assign a new session token to the user.
More than 200 different atlassian.net-related credentials and cookies have been
listed for sale on dark web marketplaces in the past 30 days. It's very possible
that many of the credentials are still in use because they were listed for sale
just 30 days ago.
On doing the Anatomy of a Stealer-Log File, some of the victim’s information

included in the stealer log are:IP,Screenshots,Location,Language,Softwares
installed,Hardware configuration,Plain text credentials for websites
visited,Cookies from all browsers used by the victim,Cryptocurrency wallets
information,Saved Debit / Credit card details.
Generally, the stealer virus that is most often used for data collection and sale
on dark web markets is VIDAR (70.9%), Redline (24.2%), Racoon (4.9%).Also According
to an analysis of data from dark web markets, stealer virus most frequently
affected Windows OS users as victims. The United States, India, and Brazil are the
top 3 nations for which stealer logs contain data.
Some Prevention Techniques which can be taken into considerations are -

1.)Encourage staff to regularly log out of sensitive applications
2.)Until a solution is made available by Atlassian, you can configure a shorter
idle session for Atlassian products on the admin.atlassian.com website under the
Security Authentication rules area.
3.)To enable re-logins, implement an idle-session timeout.
4.)Examine the forums devoted to cybercrime for the newest threat actors'
strategies.
5.)Verify whether the data from your company is offered for sale on the dark web.
That's it from my side, hope this information helps you,
Talk soon bbyee.

Atllasian Product

Uploaded by

Copyright:

Available Formats

Atllasian Product

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Atllasian Product

Uploaded by

Copyright:

Available Formats

Hi, so today we will be discussing Security Flaw in Atlassian Products (Jira,

Confluence, Trello, BitBucket) Affecting Multiple Companies.

On doing the Anatomy of a Stealer-Log File, some of the victim’s information

Some Prevention Techniques which can be taken into considerations are -

Talk soon bbyee.

You might also like