Affected Systems

Atlassian Data Center products: Bitbucket (versions before 9.4.26, 10.2.8, 10.5.1), Confluence (before 9.2.26, 10.2.19), Jira Service Management and Software (before 5.12.40/9.12.40, 10.3.26, 11.3.12), Bamboo (before 10.2.24, 12.1.12), Crowd (before 6.3.7, 7.0.3, 7.1.7, 7.2.4), Crucible and Fisheye (before 4.9.15). Atlassian Cloud products already patched.

Exploitation Status

Active exploitation confirmed. Exploitation attempts detected within two hours of watchTowr publishing technical details. 15 attempts from three IP addresses (Japan and U.S.) observed by Previdian honeypots. Nuclei template available, enabling mass automated scanning.

Business Impact

Unauthenticated attackers can read arbitrary files within the web application root directory if exact file path is known. Critical impact for Crowd and Jira: attackers can retrieve crowd.properties containing credentials, gain administrative access, create users, and escalate privileges to Jira Administrator. Vulnerability exploits path traversal in web-resource handling (converts "..::..::..::..::WEB-INF::web.xml" to "../../../../WEB-INF/web.xml"). No directory enumeration capability, but known sensitive files (tokens, credentials, keys) are at risk.

Urgency

🔴 Immediate

Recommended Actions

  • Apply vendor patches immediately for all affected Atlassian Data Center products (Bitbucket 9.4.26+/10.2.8+/10.5.1+, Confluence 9.2.26+/10.2.19+, Jira 9.12.40+/10.3.26+/11.3.12+, Bamboo 10.2.24+/12.1.12+, Crowd 6.3.7+/7.0.3+/7.1.7+/7.2.4+, Crucible/Fisheye 4.9.15+)
  • Remove Atlassian Data Center instances from public internet access or place behind VPN until patched
  • Deploy WAF rules or Tomcat RewriteValve blocks targeting path traversal patterns containing '::' sequences in /download/resources/ and /includes/ paths
  • Monitor web server logs for GET requests to /download/resources/ paths containing '..::..' patterns or targeting WEB-INF/web.xml, crowd.properties, or other sensitive configuration files
  • Block inbound traffic from known exploitation IPs: 38.60.157.86, 146.70.187.234, 159.26.119.225
  • For Crowd and Jira instances: audit administrative user accounts created in the past 48 hours and rotate Crowd credentials stored in crowd.properties after patching