• Type: Public Security Vulnerability
• Resolution: Fixed
• Priority: Low
• Fix Version/s: 9.2.3, 9.3.1
• Affects Version/s: 8.0.0, (45)
  8.0.1, 8.0.2, 8.0.3, 8.1.1, 8.0.4, 8.0.5, 8.1.2, 8.0.6, 8.2.0, 8.1.3, 8.0.7, 8.1.4, 8.2.1, 8.1.5, 8.2.2, 8.1.6, 9.0.0, 8.0.8, 8.1.7, 8.2.3, 8.1.8, 8.2.4, 8.0.9, 8.0.10, 8.1.9, 8.2.5, 8.2.6, 8.1.10, 8.0.11, 9.0.1, 9.1.0, 8.0.12, 8.1.11, 8.2.7, 9.0.2, 9.3.0, 9.2.1, 9.1.2, 8.2.8, 9.0.3, 8.0.13, 8.1.12, 9.1.3, 9.0.4, 8.2.9
• Component/s: None
• Labels:

  • advisory
  • advisory-to-release
  • bamboo-pentest-2023
  • dont-import
  • elttam
  • security
  • 🔢✅

[BAM-22400] Injection, RCE (Remote Code Execution) in Bamboo

Cathy S made changes - 14/Mar/2024 2:40 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 880526 ]

Cathy S made changes - 22/Feb/2024 10:45 PM

Remote Link

New: This issue links to "Page (Confluence)" [ 872604 ]

Collapse comment: jammsen added a comment - 09/Aug/2023 6:35 PM, Edited by jammsen - 09/Aug/2023 6:36 PM

jammsen added a comment - 09/Aug/2023 6:35 PM - edited

"Curtis: 8.2.5 and 8.2.6 are listed as affected. Maybe they weren't at first, but they are now."

Yes the were added afterwards on the day i wrote my "we are paying customers" text. I know, thanks anyway.

"Justin Isler: When will a patch be available for 8.2?"

No sadly there will not be one, you will have to upgrade to either 9.2.3+ or 9.3.1+ anything else below is affected now. (See the really transparent "Giant Version-Tag-List")

"Curtis: 8.2 was released in April 2022. It will not receive an update according to this policy."

Yeah that kinda explains it in a way, would be more transparent if the text would say, other releases are not supported anymore, therefore only 9.x+ basically, but yeah i agree.

Also thanks to Atlassian meaning 73868399605e , i hope whatever process they had where this wasnt covered will be revisited and this updated information grade will become the new standard, for better transparency for everyone and be better informed about IT-Sec related topics.

Expand comment: jammsen added a comment - 09/Aug/2023 6:35 PM, Edited by jammsen - 09/Aug/2023 6:36 PM

jammsen added a comment - 09/Aug/2023 6:35 PM - edited "Curtis: 8.2.5 and 8.2.6 are listed as affected. Maybe they weren't at first, but they are now." Yes the were added afterwards on the day i wrote my "we are paying customers" text. I know, thanks anyway. "Justin Isler: When will a patch be available for 8.2?" No sadly there will not be one, you will have to upgrade to either 9.2.3+ or 9.3.1+ anything else below is affected now. (See the really transparent "Giant Version-Tag-List") "Curtis: 8.2 was released in April 2022. It will not receive an update according to this policy." Yeah that kinda explains it in a way, would be more transparent if the text would say, other releases are not supported anymore, therefore only 9.x+ basically, but yeah i agree. Also thanks to Atlassian meaning 73868399605e , i hope whatever process they had where this wasnt covered will be revisited and this updated information grade will become the new standard, for better transparency for everyone and be better informed about IT-Sec related topics.

Collapse comment: Curtis added a comment - 09/Aug/2023 2:30 PM

Curtis added a comment - 09/Aug/2023 2:30 PM

Only 9.2 branch (which is a LTS release) and 9.3 are listed as receiving the fix.

Also, if you look at the Security Bugfix Policy, you find the following:

Issue new bug fix releases for:

• Any versions designated an 'Long Term Support release' that have not reached end of life.
• All feature versions released within 6 months of the date the fix is released.

8.2 was released in April 2022. It will not receive an update according to this policy.

Expand comment: Curtis added a comment - 09/Aug/2023 2:30 PM

Curtis added a comment - 09/Aug/2023 2:30 PM Only 9.2 branch (which is a LTS release) and 9.3 are listed as receiving the fix. Also, if you look at the Security Bugfix Policy , you find the following: Issue new bug fix releases for: Any versions designated an 'Long Term Support release' that have not reached end of life. All feature versions released within 6 months of the date the fix is released. 8.2 was released in April 2022. It will not receive an update according to this policy.

Collapse comment: Justin Isler added a comment - 09/Aug/2023 12:45 PM

Justin Isler added a comment - 09/Aug/2023 12:45 PM

@Curtis we are facing the same issue as @jammsen. Since the original question is still unanswered, here is a quote:

We currently have 8.2.6 live, is Bamboo 8.2.6 affected and if yes, whats the fix path, without Platform upgrading untested content from almost 2 years of features?

When will a patch be available for 8.2?

Expand comment: Justin Isler added a comment - 09/Aug/2023 12:45 PM

Justin Isler added a comment - 09/Aug/2023 12:45 PM @Curtis we are facing the same issue as @jammsen. Since the original question is still unanswered, here is a quote: We currently have 8.2.6 live, is Bamboo 8.2.6 affected and if yes, whats the fix path, without Platform upgrading untested content from almost 2 years of features? When will a patch be available for 8.2?

Collapse comment: Curtis added a comment - 09/Aug/2023 11:46 AM

Curtis added a comment - 09/Aug/2023 11:46 AM

@jammsen 8.2.5 and 8.2.6 are listed as affected. Maybe they weren't at first, but they are now.

Expand comment: Curtis added a comment - 09/Aug/2023 11:46 AM

Curtis added a comment - 09/Aug/2023 11:46 AM @jammsen 8.2.5 and 8.2.6 are listed as affected. Maybe they weren't at first, but they are now.

Eduardo Alvarenga made changes - 07/Aug/2023 5:29 AM

Remote Link

New: This issue links to "Page (Confluence)" [ 796754 ]

Zachary Echouafni made changes - 04/Aug/2023 6:18 AM

Description

Original: This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. h3. Vulnerable versions *All Bamboo Server and Data Center versions earlier than 9.2.3 and 9.3.1 are vulnerable.* h3. Fixed versions All Bamboo versions that contain a fix to this issue are listed on the "Fix Version/s" field of this ticket. Atlassian recommends that you upgrade your instance to latest version. If you're unable to upgrade to latest, upgrade to one of these fixed versions: 9.2.3 and 9.3.1. See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Bamboo Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]). This vulnerability was reported via our Penetration Testing program.

New: This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of Bamboo Data Center. This Injection and RCE (Remote Code Execution) vulnerability, with a CVSS Score of 7.5, allows an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction. h3. Vulnerable versions *All Bamboo Server and Data Center versions earlier than 9.2.3 and 9.3.1 are vulnerable.* h3. Fixed versions All Bamboo versions that contain a fix to this issue are listed on the "Fix Version/s" field of this ticket. Atlassian recommends that you upgrade your instance to latest version. If you're unable to upgrade to latest, upgrade to one of these fixed versions: 9.2.3 and 9.3.1. See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center and Bamboo Server from the download center ([https://www.atlassian.com/software/bamboo/download-archives]). This vulnerability was reported via our Penetration Testing program.

Eduardo Alvarenga made changes - 03/Aug/2023 6:14 AM

Affects Version/s		New: 8.0.0 [ 92814 ]
Affects Version/s		New: 8.0.1 [ 97707 ]
Affects Version/s		New: 8.0.2 [ 97610 ]
Affects Version/s		New: 8.0.3 [ 97895 ]
Affects Version/s		New: 8.1.1 [ 97096 ]
Affects Version/s		New: 8.0.4 [ 98008 ]
Affects Version/s		New: 8.0.5 [ 98593 ]
Affects Version/s		New: 8.1.2 [ 99290 ]
Affects Version/s		New: 8.0.6 [ 99296 ]
Affects Version/s		New: 8.2.0 [ 99297 ]
Affects Version/s		New: 8.1.3 [ 99896 ]
Affects Version/s		New: 8.0.7 [ 99693 ]
Affects Version/s		New: 8.1.4 [ 100291 ]
Affects Version/s		New: 8.2.1 [ 100298 ]
Affects Version/s		New: 8.1.5 [ 100592 ]
Affects Version/s		New: 8.2.2 [ 100690 ]
Affects Version/s		New: 8.1.6 [ 100494 ]
Affects Version/s		New: 9.0.0 [ 100790 ]
Affects Version/s		New: 8.0.8 [ 100901 ]
Affects Version/s		New: 8.1.7 [ 100902 ]
Affects Version/s		New: 8.2.3 [ 100903 ]
Affects Version/s		New: 8.1.8 [ 101492 ]
Affects Version/s		New: 8.2.4 [ 101493 ]
Affects Version/s		New: 8.0.9 [ 101691 ]
Affects Version/s		New: 8.0.10 [ 101699 ]
Affects Version/s		New: 8.1.9 [ 101700 ]
Affects Version/s		New: 8.2.5 [ 101701 ]
Affects Version/s		New: 8.1.10 [ 102224 ]
Affects Version/s		New: 8.0.11 [ 102225 ]
Affects Version/s		New: 9.0.1 [ 102590 ]
Affects Version/s		New: 9.1.0 [ 102591 ]
Affects Version/s		New: 8.0.12 [ 103094 ]
Affects Version/s		New: 8.1.11 [ 103095 ]
Affects Version/s		New: 8.2.7 [ 103096 ]
Affects Version/s		New: 9.0.2 [ 103491 ]
Affects Version/s		New: 9.1.2 [ 104330 ]
Affects Version/s		New: 8.2.8 [ 104331 ]
Affects Version/s		New: 9.0.3 [ 104339 ]
Affects Version/s		New: 9.0.4 [ 104670 ]

Marcin Gardias made changes - 03/Aug/2023 5:57 AM

Affects Version/s	Original: 9.1.0 [ 102591 ]
Affects Version/s	Original: 8.2.0 [ 99297 ]
Affects Version/s	Original: 8.1.1 [ 97096 ]
Affects Version/s	Original: 8.0.0 [ 92814 ]
Affects Version/s		New: 9.1.3 [ 104995 ]

Load more older events