Cloudflare has confirmed a security incident involving an unauthorized third party gaining access to an internal Atlassian server. The company stated that the attacker used stolen credentials to breach the system, which hosted its Confluence wiki, Jira bug-tracking system, and Bitbucket source code management system.
The incident, which Cloudflare discovered and contained in late 2023, was attributed to a nation-state attacker. While Cloudflare did not name the specific group, the company's assessment indicated a sophisticated and well-resourced adversary. The attack leveraged a stolen credential obtained during the Okta compromise in October 2023, where a Cloudflare employee's Okta account was compromised. This credential was subsequently used to access Cloudflare's Atlassian systems.
The attacker initially attempted to access Cloudflare's console and a dashboard for its customer relationship management (CRM) system, but these attempts were unsuccessful due to the use of hardware security keys, specifically FIDO2-compliant keys, which prevented the stolen credential from being used for multi-factor authentication.
However, the attacker successfully accessed the Atlassian server through a service account that did not require a hardware key for authentication. This access allowed the attacker to browse Cloudflare's Confluence wiki, view Jira tickets, and access some source code repositories in Bitbucket.
Cloudflare's investigation revealed that the attacker had persistent access to the Atlassian systems for a period of time, starting in November 2023. The company detected the breach on November 23, 2023, and launched an immediate investigation. Cloudflare's security team observed the attacker attempting to establish persistent access to the Atlassian server by creating a new user account.
The attacker also accessed a small number of source code repositories containing internal tools and documentation. Cloudflare confirmed that no customer data or systems were impacted by this breach. The company also stated that its global network, customer-facing products, and production systems remained secure.
Following the discovery, Cloudflare rotated over 5,000 production credentials, including secrets, service accounts, and API tokens. The company also implemented additional security measures, including isolating the Atlassian environment and enhancing monitoring. Cloudflare emphasized the importance of its use of hardware security keys as a critical defense against this type of attack, noting that their widespread adoption prevented the attacker from gaining deeper access.
