RovoBlast One-Click Attack Could Exfiltrate Enterprise Data Through Atlassian Rovo
Summary
Varonis researchers demonstrated that a crafted link could seed prompts into Atlassian Rovo and trigger its ResearchAgent to expose internal data. Atlassian fixed the flaw before publication.
Key points
- The RovoBlast flaw used the rovoChatPrompt URL parameter to seed attacker-controlled instructions into a user's Rovo session.
- Researchers found that leaving the organization ID blank still routed the link to the user's default organization, without warning that the session had been seeded externally.
- Rovo's ResearchAgent could use its multi-source browsing and automation capabilities to retrieve internal data and send it to the open web.
- Proof-of-concept scenarios demonstrated exfiltration of Confluence pages, Jira tickets, and SharePoint content containing personal data.
- Varonis disclosed the flaw to Atlassian, which fixed it before the research was published.
- Researchers recommended limiting Rovo's system access, disconnecting unused integrations, restricting sensitive areas, disabling unused automation and browsing, and monitoring assistant logs.
Article Details
- Attack Vectors
- A specially crafted link used the rovoChatPrompt URL parameter to seed attacker-controlled instructions into a user's Rovo chat session.
- The organization ID could be left blank; Atlassian would still route the request to the victim's default organization without indicating that the session had been seeded externally.
- Rovo's autonomous ResearchAgent could retrieve internal data and send it to the open web. Researchers demonstrated leaks involving Confluence pages, Jira tickets, and SharePoint content containing personal data.
- Defensive Notes
- Atlassian fixed the issue before the findings were published.
- Limit which systems Rovo can access and disconnect integrations that are not in use.
- Restrict access to sensitive areas such as legal, HR, and finance.
- Disable browsing or multistep automation features that are not actively needed.
- Routinely monitor assistant activity logs.
Vendors
Products
BitbucketRovo functions as an AI layer spanning Jira, Confluence, Bitbucket, and third-party tools such as Slack, Microsoft 365, and Google Workspace.ConfluenceRovo functions as an AI layer spanning Jira, Confluence, Bitbucket, and third-party tools such as Slack, Microsoft 365, and Google Workspace.Google WorkspaceRovo functions as an AI layer spanning Jira, Confluence, Bitbucket, and third-party tools such as Slack, Microsoft 365, and Google Workspace.JiraRovo functions as an AI layer spanning Jira, Confluence, Bitbucket, and third-party tools such as Slack, Microsoft 365, and Google Workspace.Microsoft 365 Apps for EnterpriseRovo functions as an AI layer spanning Jira, Confluence, Bitbucket, and third-party tools such as Slack, Microsoft 365, and Google Workspace.Microsoft SharePointThe team demonstrated the technique in three separate proof-of-concept scenarios: exfiltrating Confluence pages, Jira tickets, and SharePoint content containing personal data.RovoDEF CON — Varonis Threat Labs has disclosed a one-click vulnerability in Rovo, Atlassian’s enterprise AI assistant, that let a specially crafted link seed attacker-controlled instructions directly into a user’s live AISlackRovo functions as an AI layer spanning Jira, Confluence, Bitbucket, and third-party tools such as Slack, Microsoft 365, and Google Workspace.