Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-14038

Privilege escalation

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Highest Highest
    • 5.2.2
    • None
    • None

      We have identified and fixed a vulnerability in Bamboo which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Bamboo web interface.

      A Bamboo server is only vulnerable if it has been configured to be a part of an Application link with Trusted Applications authentication. This is not the default configuration.

      The vulnerability affects all supported versions of Bamboo up to and including 5.2.1. It has been fixed in 5.2.2.

      For more information, see our security advisory.

        1. patch_bamboo_5_0_1.tar.gz
          178 kB
        2. patch_bamboo_5_1_1.tar.gz
          178 kB
        3. patch_bamboo_5_2_1.tar.gz
          178 kB

            [BAM-14038] Privilege escalation

            Marek Went (Inactive) added a comment - - edited

            Please find attached patches for following Bamboo versions:

            • Bamboo 5.0.1 - patch_bamboo_5_0_1.tar.gz
            • Bamboo 5.1.1 - patch_bamboo_5_1_1_tar.gz
            • Bamboo 5.2.1 - patch_bamboo_5_2_1.tar.gz

            To apply the patch please:

            • Bamboo 5.0.1:
              • stop Bamboo
              • goto bamboo_home/webapp/WEB-INF/lib
              • move files <Bamboo-INSTALL>/webapp/WEB-INF/lib to a location outside the <Bamboo-INSTALL> folder
                • applinks-api-3.11.0-m8.jar
                • applinks-host-3.11.0-m8.jar
                • applinks-spi-3.11.0-m8.jar
                • atlassian-trusted-apps-core-2.5.2.jar
                • atlassian-trusted-apps-seraph-integration-2.5.2.jar
                • sal-api-2.9.1.jar
                • sal-spi-2.9.1.jar
                • sal-spring-2.9.1.jar
              • unpack content of attached patch in the same directory
              • start Bamboo
            • Bamboo 5.1.1:
              • stop Bamboo
              • goto bamboo_home/atlassian-bamboo/WEB-INF/lib
              • move files <Bamboo-INSTALL>/atlassian-bamboo/WEB-INF/lib to a location outside the <Bamboo-INSTALL> folder
                • applinks-api-4.0.0-m07.jar
                • applinks-host-4.0.0-m07.jar
                • applinks-spi-4.0.0-m07.jar
                • atlassian-trusted-apps-core-2.5.2.jar
                • atlassian-trusted-apps-seraph-integration-2.5.2.jar
                • sal-api-2.10.2.jar
                • sal-spi-2.10.2.jar
                • sal-spring-2.10.2.jar
              • unpack content of attached patch in the same directory
              • start Bamboo
            • Bamboo 5.2.1:
              • stop Bamboo
              • goto bamboo_home/atlassian-bamboo/WEB-INF/lib
              • move files <Bamboo-INSTALL>/atlassian-bamboo/WEB-INF/lib to a location outside the <Bamboo-INSTALL> folder
                • applinks-api-4.0.3.jar
                • applinks-host-4.0.3.jar
                • applinks-spi-4.0.3.jar
                • atlassian-trusted-apps-core-3.0.2.jar
                • atlassian-trusted-apps-seraph-integration-3.0.2.jar
                • sal-api-2.10.9.jar
                • sal-spi-2.10.9.jar
                • sal-spring-2.10.9.jar
              • unpack content of attached patch in the same directory
              • start Bamboo

            Marek Went (Inactive) added a comment - - edited Please find attached patches for following Bamboo versions: Bamboo 5.0.1 - patch_bamboo_5_0_1.tar.gz Bamboo 5.1.1 - patch_bamboo_5_1_1_tar.gz Bamboo 5.2.1 - patch_bamboo_5_2_1.tar.gz To apply the patch please: Bamboo 5.0.1: stop Bamboo goto bamboo_home/webapp/WEB-INF/lib move files <Bamboo-INSTALL>/webapp/WEB-INF/lib to a location outside the <Bamboo-INSTALL> folder applinks-api-3.11.0-m8.jar applinks-host-3.11.0-m8.jar applinks-spi-3.11.0-m8.jar atlassian-trusted-apps-core-2.5.2.jar atlassian-trusted-apps-seraph-integration-2.5.2.jar sal-api-2.9.1.jar sal-spi-2.9.1.jar sal-spring-2.9.1.jar unpack content of attached patch in the same directory start Bamboo Bamboo 5.1.1: stop Bamboo goto bamboo_home/atlassian-bamboo/WEB-INF/lib move files <Bamboo-INSTALL>/atlassian-bamboo/WEB-INF/lib to a location outside the <Bamboo-INSTALL> folder applinks-api-4.0.0-m07.jar applinks-host-4.0.0-m07.jar applinks-spi-4.0.0-m07.jar atlassian-trusted-apps-core-2.5.2.jar atlassian-trusted-apps-seraph-integration-2.5.2.jar sal-api-2.10.2.jar sal-spi-2.10.2.jar sal-spring-2.10.2.jar unpack content of attached patch in the same directory start Bamboo Bamboo 5.2.1: stop Bamboo goto bamboo_home/atlassian-bamboo/WEB-INF/lib move files <Bamboo-INSTALL>/atlassian-bamboo/WEB-INF/lib to a location outside the <Bamboo-INSTALL> folder applinks-api-4.0.3.jar applinks-host-4.0.3.jar applinks-spi-4.0.3.jar atlassian-trusted-apps-core-3.0.2.jar atlassian-trusted-apps-seraph-integration-3.0.2.jar sal-api-2.10.9.jar sal-spi-2.10.9.jar sal-spring-2.10.9.jar unpack content of attached patch in the same directory start Bamboo

              Unassigned Unassigned
              rbattaglin Renan Battaglin
              Affected customers:
              0 This affects my team
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: