Stash security advisory 2014-02-26
This advisory details a critical security vulnerability that we have found in Stash and fixed in a recent versions of Stash.
- Customers who have downloaded and installed Stash should upgrade their existing Stash installations to fix this vulnerability.
- Atlassian OnDemand customers are not affected because OnDemand does not include Stash.
The vulnerability affects all versions of Stash up to and including 2.5.3, 2.6.4, 2.7.5 and 2.8.3.
It does not affect versions 2.5.4, 2.6.5, 2.7.6, 2.8.4, 2.9.X, 2.10.X.
Atlassian is committed to improving product security. We fully support the reporting of vulnerabilities and we appreciate it when people work with us to identify and solve the problem.
If you have questions or concerns regarding this advisory, please raise a support request at http://support.atlassian.com.
User privilege escalation
Atlassian rates the severity level of this vulnerability as critical, according to the scale published in https://www.atlassian.com/security. The scale allows us to rank the severity as critical, high, moderate or low.
This is an independent assessment and you should evaluate its applicability to your own IT environment.
We have identified and fixed a vulnerability in Stash which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Stash web interface.
The Stash server is only vulnerable if it has been configured to be a part of an Application link with Trusted Applications authentication.
The vulnerability affects all supported versions of Stash up to and including 2.5.3, 2.6.4, 2.7.5 and 2.8.3. It has been fixed in the Stash security patch releases 2.5.4, 2.6.5, 2.7.6, 2.8.4. The vulnerability does not affect the Stash 2.9 and 2.10 releases. The issue is tracked in - STASH-4122Getting issue details... STATUS .
If you are unable to upgrade or patch your Stash server you can do the following as a temporary workaround:
- Block access to your Stash server web interface from untrusted networks, such as the Internet.
- Remove any Application links that use Trusted Applications authentication and re-create them using OAuth.
This vulnerability can be fixed by upgrading Stash to one of the security patch releases or any release of Stash higher than 2.9.0. If required, there is also a patch available for this vulnerability for all supported versions of Stash. If you have any questions, please raise a support request at http://support.atlassian.com. We recommend upgrading.
The Security Patch Policy describes when and how we release security patches and security upgrades for our products.
Upgrade to one of the Stash patch releases, 2.5.4, 2.6.5, 2.7.6, 2.8.4, which fixes this vulnerability, or one of the unaffected releases, 2.9 or a later version. For a full description of these releases, see the Stash Release Notes.
Binary patches are not available for this advisory. You need to either install one of the patch releases or apply recommended temporary workarounds.