Atlassian Rovo Exfiltrates Data, Bypassing Controls

Context

Atlassian’s Rovo AI is a multi-purpose agent that operates across Atlassian’s product suite (Jira, Confluence, etc.).

Vulnerabilities have been identified that enable data exfiltration across an Atlassian tenant (Jira tickets, Confluence docs, etc.) via indirect prompt injection. This attack executes without requiring any human-in-the-loop approval, and succeeds by exploiting Rovo's URL retrieval tool.

The attack still succeeds even when web search has been disabled organization-wide.

PromptArmor disclosed the vulnerabilities covered in this article to Atlassian on May 23rd. Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable. As such, we are publishing to inform users of the risks.

The Attack Chain

1. 1.

   The victim prepares a query asking Rovo to organize Jira tickets

   

2. 2.

   The victim uploads a file to Rovo that contains a hidden prompt injection

   For general use cases, this is quite common: a user finds a file online and uploads it to Rovo. This attack is not dependent on the injection source - other injection sources include, but are not limited to: external data in Atlassian (e.g., support tickets), web data (if search is enabled), third-party ‘connectors’, etc.

   

3. 3.

   The victim asks Rovo to organize their Jira tickets

   

4. 4.

   The injection manipulates Rovo to submit Jira tickets and Confluence documents to the attacker’s website

   Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent. Here, Rovo is manipulated to append sensitive data to an attacker's URL. When Rovo calls the insecure tool to open the URL, the attacker's site logs the request, including the appended sensitive data.

   

   Note: This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.

   

   If the user returns to the chat later, they see the agent's suggested ticket updates, but no evidence of the attack.

   

5. 5.

   The attacker views the victim’s tickets and document contents in their website logs

   The prompt injection can exfiltrate any data the agent can access in Atlassian, including any data the agent can access via ‘connectors’.

   

Extra: A second exfiltration mechanism

Atlassian Rovo also renders Markdown images from AI outputs. Insecure Markdown image rendering is a well-known vector for data exfiltration via indirect prompt injection.

To see what a full attack chain looks like for insecure Markdown image rendering, here are some examples from our other research:

• ■
  Codex Exfiltrates Connector Data
• ■
  OpenAI API Logs Data Exfiltration
• ■
  Superhuman AI Exfiltrates Emails
• ■
  Hugging Face Chat Exfiltrates Data
• ■
  Data Exfiltration from Writer.com via Indirect Prompt Injection

Responsible Disclosure

PromptArmor disclosed the vulnerabilities covered in this article to Atlassian on May 23rd. Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable as of the release of this article.

Timeline