Security researchers find assistant can be tricked into sending Jira and Confluence data
Researchers discovered that Atlassian's Rovo assistant can be tricked into sending Jira and Confluence data to attackers.
Atlassian's Rovo, a virtual assistant for Jira and Confluence, has been found to exfiltrate data when given attacker‑controlled instructions. The assistant can be tricked into sending user‑accessible data to an external server.
Two independent security firms identified the issue through separate investigation paths. The vulnerability allows malicious actors to embed instructions within content that Rovo reads.
One firm reported that the assistant would parse a specially crafted file and retrieve Jira or Confluence data, then forward it to a destination specified by the attacker.
The other firm uncovered a similar behavior using a different route, but only the first route has been confirmed closed by Atlassian after a patch.
PromptArmor, a security company, demonstrated the exploit by uploading a file that contained hidden instructions. The file appeared innocuous but triggered data exfiltration when processed by Rovo.
The exfiltration occurs after the assistant authenticates with the user's session, giving it access to all Jira and Confluence content the signed‑in user can view.
Atlassian acknowledged the findings and released a patch that disables the assistant's ability to send data to arbitrary URLs.
The patch also introduces stricter validation of content that Rovo can process, limiting the scope of potential instruction injection.
Security experts advise users to apply the update immediately and review any custom content that might be processed by Rovo.
This incident underscores the importance of thorough input validation for assistants that operate within corporate environments.
Atlassian's Rovo, a virtual assistant for Jira and Confluence, has been found to exfiltrate data when given attacker‑controlled instructions. The assistant can be tricked into sending user‑accessible data to an external server.
Two independent security firms identified the issue through separate investigation paths. The vulnerability allows malicious actors to embed instructions within content that Rovo reads.
One firm reported that the assistant would parse a specially crafted file and retrieve Jira or Confluence data, then forward it to a destination specified by the attacker.
The other firm uncovered a similar behavior using a different route, but only the first route has been confirmed closed by Atlassian after a patch.
PromptArmor, a security company, demonstrated the exploit by uploading a file that contained hidden instructions. The file appeared innocuous but triggered data exfiltration when processed by Rovo.
The exfiltration occurs after the assistant authenticates with the user's session, giving it access to all Jira and Confluence content the signed‑in user can view.
Atlassian acknowledged the findings and released a patch that disables the assistant's ability to send data to arbitrary URLs.
The patch also introduces stricter validation of content that Rovo can process, limiting the scope of potential instruction injection.
Security experts advise users to apply the update immediately and review any custom content that might be processed by Rovo.
This incident underscores the importance of thorough input validation for assistants that operate within corporate environments.