Atlassian's Rovo assistant can be made to send Jira and Confluence records to a server an attacker controls, according to disclosures from PromptArmor on August 5 and Varonis Threat Labs on August 8. Atlassian has fixed the path Varonis found. The one PromptArmor found was still open when the firm published.
Varonis found that a URL parameter, rovoChatPrompt, wrote text straight into a user's Rovo chat window. One click by a signed-in user ran the attacker's instructions with that user's own permissions. The researchers tested the technique against Jira, Confluence, SharePoint and Outlook connectors, and found that leaving the organization ID blank in the link still routed the request to the victim's default organization without a warning. Varonis classed the technique as parameter-to-prompt injection, delivered through the product's own URL handling. Atlassian fixed the parameter server-side on July 8 and paid a $6,000 bounty through Bugcrowd.
PromptArmor's path needs no link at all. Hidden instructions sit inside an ordinary-looking file, written in tiny white text that a reader cannot see and a model reads without difficulty. An employee uploads the file and asks Rovo for routine help, such as sorting Jira tickets. Rovo gathers records the employee can already reach, appends them to a URL on the attacker's server, and calls its own URL-retrieval tool. The request delivers the data into the attacker's server logs.
The organization-level switch that turns off Rovo's web search does not close that channel, PromptArmor said, because disabling search leaves in place the separate tool Rovo uses to open a URL. The firm tested the setting and the exfiltration still worked.
PromptArmor reported the finding to Atlassian on May 23 and received a case number two days later, then followed up on June 4 and again on July 29. It published on August 5, saying it had received no further communication. Neither finding has been assigned a CVE identifier.
Rovo is switched on by default for Atlassian's Standard, Premium and Enterprise plans, and it can reach whatever the signed-in user's permissions reach, plus data in connected third-party apps.
PromptArmor's route is indirect prompt injection, in which content an assistant reads carries instructions the assistant then follows. Researchers used the same class of attack to plant a false memory in an AI assistant with a single email in July. A group of security vendors is selling controls that treat agents as enterprise identities, with scoped permissions and audit trails.
Atlassian has not confirmed a fix for the file-borne path.
Sources: PromptArmor, SecurityWeek, The Hacker News
–
By the Control Plane Editorial Team