Malicious URLs can trigger Atlassian Rovo AI to leak sensitive enterprise data
A one-click vulnerability in Atlassian's Rovo AI assistant allows attackers to seed malicious instructions into a user session via a crafted URL. This flaw enables the autonomous ResearchAgent tool to pull internal data from connected services and push it to the open web. Atlassian has fixed the issue, but defenders should review integration permissions immediately.
Summary
Researchers at Varonis Threat Labs have disclosed a vulnerability dubbed "RovoBlast" that targets Atlassian Rovo, an AI layer integrated across Jira, Confluence, Bitbucket, and various third-party tools like Slack and Microsoft 365. The flaw relies on a parameter-to-prompt (P2P) injection technique where a specially crafted link pre-fills the Rovo chat window with attacker-controlled instructions.
The vulnerability bypasses traditional security boundaries without requiring a jailbreak or permission bypass. Because Rovo can act as an autonomous agent to complete multi-step tasks, a single seeded prompt can trigger a chain reaction that exfiltrates sensitive information from an organization's internal environment to external websites.
How the attack works
The attack exploits a specific URL parameter, rovoChatPrompt, which is designed to pre-fill content directly into a Rovos chat window. Researchers discovered that if the organization ID portion of the URL is left blank, Atlassian still routes the request into the victim's default organization. This occurs without any warning or indicator that the session has been seeded by an external source.
Once the prompt is injected, the attack leverages Rovo's ResearchAgent tool. This built-in feature is capable of conducting multi-source web research and navigating arbitrary sites. By combining the seeded instructions with this autonomous capability, the AI can retrieve internal data-such as Jira tickets or Confluence pages-and push that content out to the public internet in a single automated chain.
Technical details
The potential blast radius for RovoBlast is extensive due to the breadth of integrations the assistant maintains. Testing revealed that Rovo has access to:
- Jira and Confluence
- Bitbucket
- Slack
- Google Workspace
- Microsoft 365
- Relational databases, uploaded files, and web pages
The researchers demonstrated three specific proof-of-concept scenarios where the flaw was used to exfiltrate Confluence pages, Jira tickets, and SharePoint content containing personal data. A single seeded link is generally sufficient to trigger these leaks; the attack does not require multiple requests or additional bypass steps to summarize and move sensitive data.
Defender guidance
Atlassian has implemented a fix for this vulnerability, but organizations should take specific steps to limit the potential impact of AI-driven exfiltration:
- Restrict Integrations: Limit which systems Rovo can access and immediately disconnect any third-party integrations that are not actively required for business operations.
- Segment Sensitive Data: Wall off high-sensitivity areas-such as HR, legal, and finance departments-from the AI's reach to prevent automated scraping of sensitive files.
- Control Autonomous Features: Disable browsing or multi-step automation features if they are not essential to your current workflows.
- Monitor Activity Logs: Implement routine monitoring of assistant activity logs to identify unusual patterns of data retrieval or external communication.
Sources
