A vulnerability, dubbed "RovoBlast" by Varonis Threat Labs, was discovered in Atlassian's enterprise AI assistant, Rovo, allowing for the exfiltration of company data through a single crafted link. The flaw was disclosed to Atlassian by Varonis, which published its analysis on August 7 after presenting the research at DEF CON 34. Atlassian has since confirmed and fixed the issue.
Rovo functions as an AI layer integrated across Atlassian products like Jira, Confluence, and Bitbucket, and also connects to services such as Slack, Microsoft 365, and Google Workspace. The assistant is capable of accessing and summarizing content from these platforms, as well as relational databases, uploaded files, web pages, and archives, with Atlassian's connector catalog supporting over 50 platforms.
The core of the RovoBlast vulnerability lies in a "Parameter-to-Prompt" mechanism, where Rovo accepted a URL parameter that pre-filled its chat entry with attacker-controlled instructions. This meant that a victim, already authenticated in their browser, only needed to click a specially crafted link. No warning or confirmation was presented to the user, and the session was not marked as having been initiated from an external parameter. Varonis noted that the organization identifier in the URL path could even be left empty, with Atlassian redirecting the request to the user's default organization.
Varonis characterized Rovo's safeguards against untrusted prompts as "almost non-existent," observing that a single click was typically sufficient for the assistant to retrieve and summarize sensitive material without requiring any bypass techniques.
To facilitate data leakage, Varonis identified an existing outbound path within Rovo: its "ResearchAgent." This agent is designed for multi-source open web research and can autonomously browse and navigate arbitrary websites across multiple steps. This functionality allowed for a complete attack chain within a single agent run: retrieve internal content, transform it, and then post it to an externally accessible location. Chaining these steps within one agent also minimized user-facing interactions, resulting in an audit trail that resembled ordinary research activity.
Compounding the exposure, Rovo cannot be fully uninstalled from an Atlassian environment, meaning organizations cannot eliminate the attack surface by removing the assistant entirely.
Varonis recommended several mitigation strategies. These include limiting the scope of what the assistant can access, disconnecting unused integrations, and explicitly excluding sensitive content from legal, HR, finance, and incident response departments from Rovo's reach. Additionally, Varonis advised disabling browsing agents and multi-step automation where they are not essential, regularly reviewing assistant logs, configuring alerts for unusual agent runs, and periodically testing how an environment responds to seeded prompts.
