Varonis Threat Labs disclosed RovoBlast, a one-click attack against Atlassian Rovo that injects attacker-controlled instructions through a crafted link and can make the assistant treat external parameters as trusted session input. The flaw can expose data across Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace, and other connected systems, and Atlassian fixed the issue before it was presented at DEF CON 34. #RovoBlast #Atlassian #Rovo #DEFCON34
Keypoints
- Varonis Threat Labs found a vulnerability in Atlassian Rovo called RovoBlast.
- A single click on a crafted link can trigger attacker instructions inside a trusted Rovo session.
- The attack abuses the rovoChatPrompt parameter to seed content directly into Rovo Chat.
- Rovo can access a wide range of organizational data sources, including Jira, Confluence, Bitbucket, Slack, Google Workspace, Microsoft 365, databases, uploaded files, and web pages.
- Rovo’s autonomous ResearchAgent can help turn internal data into externally reachable output through multi-step browsing and posting.
- The researchers found little to no meaningful guardrails, warnings, or confirmation prompts during testing.
- Atlassian fixed the issue after responsible disclosure, and the research was later presented at DEF CON 34.
MITRE Techniques
- [T1204.001 ] User Execution: Malicious Link – The attack requires the victim to click a crafted URL that seeds instructions into Rovo’s trusted session (‘a single click on a crafted link could turn a benign URL parameter into a Parameter-to-Prompt pathway’).
- [T1098 ] Account Manipulation – The attack abuses trusted user-session context so actions run under a legitimate identity and inherit existing access (‘Actions executed under a legitimate user identity inherit existing access’).
- [T1059 ] Command and Scripting Interpreter – Attacker-supplied instructions are executed automatically inside the assistant workflow as if they were commands (‘Rovo will happily run attacker-supplied instructions’).
- [T1203 ] Exploitation for Client Execution – A crafted link causes the client-side AI chat flow to execute maliciously injected content without jailbreaks or bypasses (‘a crafted link using rovoChatPrompt auto-surfaces content directly into Rovo Chat’).
- [T1213 ] Data from Information Repositories – Rovo searches across internal repositories and connected SaaS sources to collect sensitive organizational data (‘Rovo searched across organizational content… and summarized sensitive information with ease’).
- [T1020 ] Data Exfiltration – ResearchAgent can push collected data outward through browsing and posting actions, creating an exfiltration path (‘fetch → transform → upload is just a chain of actions away’).
- [T1105 ] Ingress Tool Transfer – The assistant can move content across connected tools and services as part of its autonomous actions (‘multi-step browsing and posting’ and ‘connected SaaS tools’).
Indicators of Compromise
- [URL parameter ] Crafted Rovo injection link –
rovoChatPrompt,rovoChatPathway=chat(used to inject attacker content into Rovo Chat) - [URL path ] Organization chat route –
/o//chat,https://home.atlassian.com/chat?rovoChatPathway=chat&rovoChatPrompt=(example routes used in the exploit) - [Product / service names ] Targeted data sources and integrations – Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace, and other connected SaaS tools (systems that Rovo could search and summarize)
- [Platform / tool ] Agent capability used for leakage – ResearchAgent (autonomous browsing and multi-step actions used to facilitate exfiltration)
Read more: https://www.varonis.com/blog/rovoblast