Auditing Atlassian Plugins, 53 0-Days Later

The blog post discusses the auditing of Atlassian plugins, revealing the discovery of 53 zero-day vulnerabilities. It begins by examining the Atlassian marketplace, where plugins are listed under certain security requirements, although the review process lacks transparency regarding the frequency and nature of security checks. The post details the structure of plugins, particularly focusing on the atlassian-plugin.xml file, which describes the plugin's functionality. A specific example of a macro is provided, illustrating how user-controlled input can lead to cross-site scripting (XSS) vulnerabilities due to inadequate input validation and output sanitization.

The authors highlight the potential impact of XSS vulnerabilities, including session hijacking and unauthorized actions performed on behalf of victims. They outline their methodology for identifying vulnerabilities, which includes downloading, decompiling, and analyzing plugins, followed by dynamic testing. To streamline this process, they developed a tool named "atlpie" to automate tasks such as scraping plugins and extracting information.

The ongoing research has led to the identification of multiple vulnerabilities across various plugins, with a commitment to responsibly disclose these issues to Atlassian. The authors conclude by advising caution in using plugins, emphasizing the need for regular audits and awareness of the additional security risks they introduce. The post serves as a reminder that reliance on vendor assurances regarding plugin security may not be sufficient.