Slashdot Mirror
Backdoor Discovered In Atlassian Crowd
An anonymous reader writes "Recently published on the Command Five website is a technically detailed threat advisory (PDF) in relation to a recurring vulnerability in Atlassian Crowd. Tucked away inconspicuously at the end of this document in a section entitled 'Unpatched Vulnerabilities' is the real security bombshell: Atlassian's turnkey solution for enterprise single sign-on and secure user authentication contains an unpatched backdoor. The backdoor allows anyone to remotely take full control of a Crowd server and, according to Command Five, successful exploitation 'invariably' results in compromise of all application and user credentials as well as accessible data storage, configured directories (for example Active Directory), and dependent systems."
What is Atlassian Crowd, where is it used, how does this effect me, why should I care?
Did I miss any important questions?
[Fuck Beta]
o0t!
Atlassian has absolute contempt for their paying customers. Each release of JIRA has functionality and flexibility that people actually want removed in the name of making it easier to use for new users. JIRA and Crucible use some monstrosity of JavaScript that causes lag when typing into intput fields, and certain versions clash with Ghostery in a way that causes certain characters (e.g. spaces) to be swallowed. It's sad, but it doesn't surprise me at all that they don't care about security in an authentication system.
https://jira.atlassian.com/browse/CWD-3366
While it is nice for the persons in charge of this obscure software to be notified about a problem on Slashdot, I am not sure I would be very happy to see that generalized.
But that leads to a real question: how do you learn about vulnerabilities for the softwares you are in charge?
Unless it starts to really, really hurt selling this kind of trash, not fixing _known_ vulnerabilities and not using secure coding practices, nothing will change. It is just cheaper this way and most customers do not care or cannot do anything anyways. One reason surely is managers at the customers that made this broken decision or supported it and now cannot back out without hurting themselves. Another is that absolutely nothing is going to happen to the vendor legally.
Unless we start to require sound secure software engineering practices OR ELSE! nothing will change.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Today I learned about Atlassian, a company whose software I will never use.
Confluence works fine, but you have to be willing to throw the right hardware at it, or be willing to tune it. Something like Doku or Mediawiki is alot less resource intensive, but Confluence is, in a nutshell, a java app, and you need to treat it accordingly. Once tuned and scaled properly, it works just as well as any other wiki, and I personally find formatting for it to be alot easier, as well as the actual management of it.
I work for Atlassian and the author has not yet disclosed the vulnerability described in the "UNPATCHED VULNERABILITIES" section to us.
Atlassian provides source code for most of our products (including Crowd) to paying customers. We would never deliberately build a backdoor into any of our products and I personally would never work for a company that would do that.