Server Side Request Forgery Vulnerability in Atlassian Application Links

CVE-2017-18096

Summary

The OAuth status REST resource in Atlassian Application Links prior to version 5.2.7, as well as select versions in the 5.3.x and 5.4.x series, is affected by a security vulnerability that allows remote attackers with administrative privileges to exploit Server Side Request Forgery. By establishing an OAuth application link to a malicious location, attackers can redirect requests to an internal network location, potentially exposing sensitive information. In environments such as Amazon EC2, this could be leveraged to access metadata resources containing access credentials and other confidential data.

References