Atlassian’s enterprise AI assistant, Rovo, has been found to have a critical vulnerability, as revealed by Varonis Threat Labs at DEF CON. The flaw, named RovoBlast, allowed attackers to inject commands directly into a user’s AI session using a specially crafted link. This vulnerability posed a significant risk to enterprise data security.
Understanding the RovoBlast Flaw
The RovoBlast vulnerability exploited the AI assistant’s handling of input parameters. By treating externally supplied parameters as trusted input, it bypassed the need for any jailbreak or permission circumvention. Rovo’s integration with tools like Jira, Confluence, Bitbucket, and others enabled attackers to execute multi-step tasks autonomously, which facilitated the exploit.
The attack was executed using a URL parameter, rovoChatPrompt, which preloaded content into Rovo’s chat interface. This method, described as parameter-to-prompt (P2P) injection, was previously reported in Microsoft’s Copilot under the term Reprompt. The researchers observed that when the organization ID in the URL was left blank, Atlassian would still process the request, inadvertently routing it to the victim’s default organization.
Implications and Potential Data Exposure
In assessing the vulnerability’s impact, researchers queried Rovo on its accessible data scope. The AI revealed access to Jira, Confluence, Bitbucket, Slack, and other platforms, demonstrating a wide data exposure potential. The ResearchAgent tool within Rovo, which can autonomously conduct web research, played a crucial role in data leakage once compromised through the malicious link.
Proof-of-concept demonstrations showcased the ability to extract data from Confluence pages, Jira tickets, and SharePoint content. Notably, a single link was sufficient to trigger the leak without needing multiple requests or additional steps, highlighting the attack’s efficiency.
Mitigation and Recommendations
Following the disclosure of RovoBlast, Atlassian took swift action to rectify the issue. Organizations are advised to restrict Rovo’s system access, disconnect unused integrations, and isolate sensitive areas such as legal, HR, and finance. Disabling non-essential browsing or automation features and regularly monitoring assistant activity logs are also recommended measures.
In a statement, Atlassian emphasized its commitment to customer data security, highlighting ongoing efforts to implement protective controls and develop additional solutions. They advised users to follow security best practices and verify the trustworthiness of content used in Atlassian apps.
Varonis presented the detailed findings at DEF CON, with further technical insights available on their blog. This incident underscores the need for vigilance in AI system security across industries.
