DEV Community

Anoymask
Anoymask

Posted on Edited on

Atlassian CVE-2026-21589: Unauthenticated Access to Files in Web Root Across Multiple Data Center Products

#security #threatintel

1. Overview

2. Executive Summary

Unauthenticated remote attackers can access files within the web root by providing exact file names and paths. Attack attempts were observed following a public PoC release, and a conditional admin account creation chain was verified in Crowd-integrated Jira.

3. Attack Flow

  1. An attacker connects to an affected self-hosted instance from the internet or a reachable network. No credentials are required.
  2. The attacker specifies the exact name and path of the target file and sends a request containing the traversal pattern indicated in the advisory.
  3. If successful, the attacker gains access to the specified file within the web application root. Directory listing and general enumeration of the entire filesystem are not described.
  4. watchTowr reproduced an application credential acquisition and conditional admin account creation chain using a Jira test environment configured with Crowd SSO where WEB-INF/classes/crowd.properties was present. Subsequent operations require valid credentials, network reachability to Crowd, adherence to application source IP restrictions, and permissions to create users and add them to Jira administrator groups. Crowd integration or file read alone does not grant admin privileges.
  5. Previdian observed attack attempts in a honeypot within two hours after the public PoC release, but successful file retrieval or admin creation has not been reported in real-world victim environments.

4. Attacker Position and Execution Context

  • An unauthenticated remote attacker with HTTP reachability to the target instance.
  • The attack is processed at the web layer of the Atlassian application, and the readable scope is limited to specific files within the web application root.
  • The cloud edition has already been patched by Atlassian, requiring no action from cloud customers.

5. Impact on Victims and Administrators

  • Users: Standard user interfaces may show no visible changes.
  • Administrators: Access logs or WAF logs may contain traversal patterns combining .., encoded slashes, backslashes, colons, or semicolons, along with requests to unusual file paths.
  • Successful reads should not be determined solely by HTTP status codes; they must be correlated with response sizes, target files, and subsequent authentication or configuration operations.

6. Conditions for Success and Failure

Conditions for Success

  • Network reachability to an affected product version prior to the patch.
  • The existence of a valuable file within the web application root, with the attacker knowing its exact name and path.
  • Requests are not blocked by temporary mitigations such as WAFs, proxies, RewriteValves, or URL rewrites.
  • When proceeding with the Crowd chain, requirements include the presence of WEB-INF/classes/crowd.properties via Crowd SSO configuration, reachability to Crowd along with source IP restrictions, and permissions for the application to create users and add them to Jira administrator groups.

Conditions for Failure

  • Updating to the patched version corresponding to the product and maintenance stream across all cluster nodes and Bitbucket mirror or mirror farm nodes.
  • Disconnecting the instance from the internet or restricting external network access until updates are applied.
  • Verifying that regular expression-based blocking by WAFs or proxies is available for all targeted products and can block URL-encoded patterns.
  • In-product mitigations use Tomcat's RewriteValve for Confluence, JSM, Jira, Bamboo, and Crowd, and urlrewrite.xml for Bitbucket. Follow official instructions to take backups, apply changes to all nodes (including Bitbucket mirror and mirror farm nodes), and execute product-specific restart procedures (official instructions require restarts after configuring the Tomcat RewriteValve and after adding rules to Bitbucket's urlrewrite.xml). Do not apply these in-product procedures to Crucible or Fisheye. Temporary mitigations do not replace patches.

Patched versions are listed below. Each number represents the fix level for a specific product and maintenance stream. Do not judge versions from different streams as patched using simple numeric comparisons; if no patched version is listed for a stream, migrate to an official patched version.

Product Patched Version
Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1
Confluence Data Center 9.2.26, 10.2.19
Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12
Jira Software Data Center 9.12.40, 10.3.26, 11.3.12
Bamboo Data Center 10.2.24, 12.1.12
Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4
Crucible 4.9.15
Fisheye 4.9.15

Official advisories target all versions prior to the patched versions. Meanwhile, CNA record descriptions list product-specific introduction versions, and the lower bounds of the affected ranges do not match. Do not exclude older versions based solely on this discrepancy.

7. What Happens Upon Success

  • Specific files within the web application root may be read without authentication.
  • If file contents include credentials, tokens, or configuration details, they may be utilized for subsequent compromises.
  • Directory listing, access to the entire arbitrary filesystem, and code execution have not been confirmed in the advisory.

8. Observable Logs

  • Email: No description indicates email is used for initial intrusion.
  • Proxy / SWG / DNS: Check for requests containing .., encoded variants of slashes, backslashes, and colons, unusual file paths, and response sizes.
  • Endpoint / EDR: Monitor application processes for file reads, unauthorized access to configuration files, and subsequent child processes or outbound communications. Some configurations may lack file read telemetry.
  • Identity / IdP: Because access occurs prior to authentication, standard login success events may be absent. Separately verify subsequent logins utilizing leaked secrets.
  • SaaS / Cloud: The Atlassian Cloud edition has been patched. Verify token usage and configuration changes in self-hosted integration destinations.
  • Network: Monitor internet-facing instances for traversal patterns and scans attempting multiple products and paths from a single source.

9. Determining Attack Success

Confirmed in Public Information

  • Attack Attempts Observed (Success Unconfirmed): Previdian observed requests targeting CVE-2026-21589 in a honeypot within two hours of watchTowr's public PoC and reported three source IPs. Successful file reads and actual damages remain unconfirmed.
  • File Read Confirmed in Test Environment: watchTowr reproduced file reading within Tomcat application contexts across Jira, Confluence, and Bitbucket by utilizing web-resource paths where double colons are converted to slashes.
  • Conditional Subsequent Chain Verified: In a test environment where crowd.properties was placed via Crowd SSO configurations, Jira admin account creation was reproduced under conditions satisfying Crowd reachability, source IP restrictions, and user/admin group addition permissions. Success in real-world environments remains unconfirmed.

Internal Determination Criteria

  • Attack Attempts Observed (Success Unconfirmed): Treat requests matching detection patterns as investigation candidates, verifying whether they constitute attack attempts based on target paths, requests, and responses. Pattern matching alone does not indicate successful file retrieval.
  • Information Theft or Session Compromise Confirmed: Correlate traversal patterns, target files, and successful responses; conclude file access was successful if evidence shows the contents of non-public files were returned.
  • Do not determine success based solely on HTTP 200 responses or pattern matches; verify caches, error pages, and rewritten paths.

10. Investigation Playbook

  • Investigation Origin: Advisory traversal patterns, requests to unknown paths, WAF alerts, and reads to sensitive files.
  • Initial Verification: Identify product versions, all cluster nodes and mirrors, exposure duration, external reachability, and the application times of temporary mitigations.
  • Endpoint and Server Investigation: Preserve access logs, WAF/proxy logs, application logs, file access telemetry, and modification histories for configurations and secrets.
  • Identity and Cloud Investigation: If target files contain credentials or tokens, review integration usage histories and sessions.
  • Tracking Subsequent Operations: Track secret utilization, administrative actions, repository, ticket, or page access, child processes, and outbound communications.
  • Containment: Restrict external access, preserve evidence, apply patches, and revoke necessary credentials or tokens.
  • Determination Categories: Differentiate between scans, request arrivals, successful file reads, secret exposures, subsequent authentications, and additional compromises.

11. Defense and Detection Ideas

  • Single Events: Detect and block requests matching Atlassian's regular expressions at WAFs and proxies.
  • Time-Series Correlation: Correlate traversal requests → sensitive file responses → logins or administrative actions from new sources.
  • Threat Hunting: Search for public, unpatched Atlassian Data Center products and accesses to web root files that are not normally referenced.
  • Log Limitations: Depending on TLS termination points, URL normalization, and decoding orders for encoded characters, paths visible to proxies and applications may differ.
  • Priority Countermeasures: Prioritize updating all nodes, restricting internet exposure, applying temporary WAF rules, and checking for secret exposures.

12. Facts, Inferences, and Hypotheses

Facts

  • CVE-2026-21589 is a vulnerability in eight self-hosted and Data Center product lines allowing pre-authentication access to specific files within the web application root.
  • Attackers must know the exact name and path of the file; directory contents cannot be enumerated.
  • Atlassian rated this with a CVSS v4 score of 9.3, and cloud products have already been patched. Patched versions for self-hosted products are Bitbucket 9.4.26/10.2.8/10.5.1, Confluence 9.2.26/10.2.19, Jira Service Management 5.12.40/10.3.26/11.3.12, Jira Software 9.12.40/10.3.26/11.3.12, Bamboo 10.2.24/12.1.12, Crowd 6.3.7/7.0.3/7.1.7/7.2.4, and Crucible/Fisheye 4.9.15.
  • watchTowr reproduced application credential acquisition and conditional admin account creation chains in a Jira test environment where WEB-INF/classes/crowd.properties was placed via Crowd SSO configurations. Subsequent operations require valid credentials, satisfied Crowd reachability and source IP restrictions, and permissions to create users and add them to Jira administrator groups. Previdian observed attack attempts within two hours of the public PoC, but success in real-world environments has not been confirmed.

Inference

  • Environments where configuration or secret files within the web root were retrieved require credential and token revocation as well as subsequent usage investigations even after patching.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in section 14.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Crafted unauthenticated requests can exploit affected internet-facing applications. File reads were reproduced in test environments; observed attack attempts do not establish successful file retrieval in real-world victim environments.

14. Open Questions and Further Investigation

  • Reachability routes, retrievable files, and configuration-dependent impact variations across unverified products and versions.
  • Discrepancies between advisory "all versions" statements and product-specific introduction versions listed in CNA records. Verification with Atlassian is required to determine applicability for older versions.
  • Whether requests from the three observed source IPs succeeded in reading files or reached real-world victim environments.
  • The scale of attacks following the public PoC, victimized organizations, and the presence of Crowd credential usage, admin account creation, or data theft.
  • Retrievable files within each organization's web root and the specific impact of their exposure.

15. Impact on SOCs and Organizations

This vulnerability affects multiple core development and business products, including Confluence, Jira, and Bitbucket. Attack attempts have been reported following the public PoC, and a Nuclei scanning template is also available. Verify updates across all Data Center nodes and mirrors; do not stop at WAF alerts but track responses, WEB-INF file accesses, Crowd APIs, and Jira admin account creations. In Crowd-integrated environments, also check application credential rotation and allowlists.

16. Summary by Role

  • For SOCs: Correlate PoC patterns, reported IPs, WEB-INF responses, crowd.properties accesses, Crowd APIs, and Jira admin account creations, distinguishing between observed requests and actual successes.
  • For Administrators: Update all cluster nodes and mirrors to patched versions, and restrict external reachability until updates are complete.
  • For Users: No user action is required. Administrators must update servers and check for evidence of compromise.

Top comments (0)