This advisory details a critical security vulnerability that we have found in Crucible and fixed in recent versions of Crucible.

• Customers who have downloaded and installed Crucible should upgrade their existing Crucible installations to fix this vulnerability.  
• Atlassian OnDemand customers are not affected because OnDemand does not include Crucible.

The vulnerability affects all versions of Crucible up to and including 3.1.5 and 2.10.7.

Atlassian is committed to improving product security. We fully support the reporting of vulnerabilities and we appreciate it when people work with us to identify and solve the problem.

If you have questions or concerns regarding this advisory, please raise a support request at http://support.atlassian.com.

User privilege escalation

Severity

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in https://www.atlassian.com/security. The scale allows us to rank the severity as critical, high, moderate or low.

This is an independent assessment and you should evaluate its applicability to your own IT environment.

Description

We have identified and fixed a vulnerability in Crucible which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Crucible web interface. 

A Crucible server is only vulnerable if it has been configured to be a part of an Application link with Trusted Applications authentication. Unless you chose OAuth authentication when configuring previously created links, Trusted Applications was used by default.

The vulnerability affects all supported versions of Crucible up to and including 3.1.5 and 2.10.7. It has been fixed in 3.2.0, 3.1.6 and 2.10.8. The issue is tracked in  CRUC-6662 - Getting issue details... STATUS .  

Risk Mitigation

If you are unable to upgrade your Crucible server you can do the following as a temporary workaround:

• Block access to your Crucible server web interface from untrusted networks, such as the Internet.
• Remove any Application links that use Trusted Applications authentication and re-create them using OAuth.

Fix

This vulnerability can be fixed by upgrading Crucible. If you have any questions, please raise a support request at http://support.atlassian.com. We recommend upgrading.

The Security Patch Policy describes when and how we release security patches and security upgrades for our products.  Only security upgrades are released for Crucible. Patches are not released for Crucible.

Upgrading Crucible

Upgrade to Crucible 3.2.0, 3.1.6, 2.10.8 or a later version, which fixes this vulnerability. For a full description of these releases, see the Crucible Release Notes.

Patches

Binary patches are not available for this advisory. You need to either install one of the patch releases or apply recommended temporary workarounds.