Atlassian Patches Over Two Dozen Vulnerabilities Including a Critical Bug in Bamboo

March 21, 2024

Atlassian has patched a series of security vulnerabilities, including a critical flaw that affects its Bamboo Data Center and Server. This flaw could be exploited without any user interaction. The most severe of these vulnerabilities, identified as CVE-2024-1597, is an SQL injection flaw that originates in a dependency known as org.postgresql:postgresql. Despite its critical nature, Atlassian has stated that this vulnerability 'presents a lower assessed risk.'

The company further explained, 'This org.postgresql:postgresql dependency vulnerability [...] could allow an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.'

According to details provided in the National Vulnerability Database (NVD) maintained by NIST, the flaw lies in 'pgjdbc, the PostgreSQL JDBC Driver, [which] allows attacker to inject SQL if using PreferQueryMode=SIMPLE.' SQL injection becomes possible when the non-default connection property preferQueryMode=simple is used in conjunction with application code that has a vulnerable SQL that negates a parameter value. However, there is no vulnerability when using the default query mode. Users who do not override the query mode are not impacted.

The vulnerability in question was introduced in certain versions of Bamboo Data Center and Server. Atlassian has clarified that Bamboo and other Atlassian Data Center products are not affected by CVE-2024-1597 as they do not use the PreferQueryMode=SIMPLE in their SQL database connection settings.

The credit for discovering and reporting this flaw goes to security researcher Paul Gerste from SonarSource. Atlassian users are urged to update their instances to the most recent version to safeguard against potential threats.

Latest News

Like what you see?

Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.

Subscribe Below

By submitting this form, you’re giving us permission to email you. You may unsubscribe at any time.

Accelerate Security Teams

Continuously identify and prioritize the risks that are most critical in your environment, and validate that your remediation efforts are reducing risk. An always-on single source-of-truth of your assets, services, and vulnerabilities.