Security

Atlassian scrambles to fix zero-day security hole accidentally disclosed on Twitter

Exposed private cert key may also be an issue for IBM Aspera

By Thomas Claburn in San Francisco

10 SHARE

Updated Twitter security celeb SwiftOnSecurity on Tuesday inadvertently disclosed a zero-day vulnerability affecting enterprise software biz Atlassian, a flaw that may be echoed in IBM's Aspera software.

The SwiftOnSecurity Twitter account revealed that Atlassian provided a domain that resolved to a local server with a common SSL certificate for its Confluence cloud service, to enable the Atlassian Companion app to edit files in a preferred local application and save the files back to Confluence.

Confluence connects to its companion app through the browser using the rather unwieldy domain: https://atlassian-domain-for-localhost-connections-only.com.

The problem with this arrangement is that anyone with sufficient technical knowledge could copy the SSL key and use it to conduct a man-in-the-middle attack that could allow an attacker to redirect app traffic to a malicious site.

Google security engineer Tavis Ormandy confirmed that anyone using the app could be subjected to such an attack.

As Ormandy explained, "you can just grab the private key, and nothing is stopping you resolving this domain to something other than localhost. Therefore, no guarantee that you're talking to a trusted local service and not an attacker."

SwiftOnSecurity reported the issue to Atlassian and obtained CVE-2019-15006 for the bug.

In an email to The Register, Atlassian said it's aware of the issue and is actively working to resolve it. "We have requested that the certificate be revoked, and we're evaluating whether other technical solutions are required to protect our customers," a company spokesperson said.

DevOpsery-dispenser Atlassian's customers settle into the cloudy subscription world

READ MORE

In the Twitter discussion, Tim Stone, a moderator for StackApps, observed that IBM's Aspera plugin client uses a similar server scheme, local.connectme.us, for client-server communication.

According to Ormandy, that has the potential to be even worse. "There's a pre-generated CA certificate and a private key, if they add that to the system store, they're effectively disabling SSL," he wrote. "I would consider that *critical*."

There's no indication at the moment that IBM does add that certificate to its system store, according to Stone.

Nonetheless, Ormandy contends the certificate issue with local.connectme.us is real and argues the certificate should be revoked.

The Register asked IBM for comment but we've not heard back. ®

Updated to add

After the story was filed, an IBM spokesperson responded by noting that the tech giant issued a security bulletin for denial of service vulnerability affecting Aspera Connect 3.7 and 3.8 back in June. "We left the local.connectme.us in for backward compatibility while customers continue to upgrade their environments," the spinner explained.

Also, we note, the certificate for local.connectme.us has been revoked.

Sign up to our NewsletterGet IT in your inbox daily

10 Comments

Keep Reading

Google's OpenSK lets you BYOSK – burn your own security key

Now there's no excuse

SecureX gon give it to ya: Cisco muscles into the integrated security game

Push to get punters inhaling one cloudy product

IoT security? We've heard of it, says UK.gov waving new regs

Department of Fun straps on a holster, strides into the wild west of online gadget users

Zyxel storage, firewall, VPN, security boxes have a give-anyone-on-the-internet-root hole: Patch right now

It's 2020 and pre-auth, superuser command injection is still a thing

Remember those infosec fellas who were cuffed while testing the physical security of a courthouse? The burglary charges have been dropped

And it only took, er, four and a half months for people to see sense

Judge to interview Assange over claims Spanish security firm snooped on him during Ecuador embassy stint

Video link request from September finally granted

How does £36m sound, mon CHERI? UK.gov pumps cash into Arm security research

That's 'Capability Hardware Enhanced RISC Instructions'

SIEMs like a stretch: Elastic searches for cash from IT pros with security budgets

Black Hat Europe Open-source product now has yet another paid option on top

Tech Resources

Reduce Redis Enterprise Deployment Cost, Complexity with Intel® Optane™ DC Persistent Memory

Intel and Redis Labs have prepared this kit to help you reduce Redis Enterprise deployments cost and complexity with 2nd Generation Intel® Xeon® Scalable processors and Intel® Optane™ DC persistent memory.

Build A Digital Experience Portfolio

The strategy and technology you need to create tomorrow’s digital experiences

Intel & SAP: Bringing the Memory Revolution to Your Intelligent Enterprise

SAP and Intel have collaborated on memory & processor co-innovation to help you deliver the intelligent enterprise.

Guide to Antivirus (AV) Replacement

This guide provides in-depth information from leading security experts that will guide you through each phase of your decision-making process.