PromptArmor 持续监控您在第三方 AI 供应商、技能、插件、连接器、MCP 服务器、模型等方面的投资组合。
我们检测漏洞和此类变化，提前揭示风险，防止其成为事件。
评估和监控 AI 供应商的风险，利用关于新兴威胁的新型情报。
Atlassian AI ‘Rovo’ is susceptible to zero-click data exfiltration via indirect prompt injection, bypassing organization-level web search controls.
Atlassian’s Rovo AI is a multi-purpose agent that operates across Atlassian’s product suite (Jira, Confluence, etc.).
Vulnerabilities have been identified that enable data exfiltration across an Atlassian tenant (Jira tickets, Confluence docs, etc.) via indirect prompt injection. This attack executes without requiring any human-in-the-loop approval, and succeeds by exploiting Rovo's URL retrieval tool.
This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.
PromptArmor disclosed the vulnerabilities covered in this article to Atlassian on May 23rd. Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable. As such, we are publishing to inform users of the risks.
The victim prepares a query asking Rovo to organize Jira tickets
The victim uploads a file to Rovo that contains a hidden prompt injection
For general use cases, this is quite common: a user finds a file online and uploads it to Rovo. This attack is not dependent on the injection source - other injection sources include, but are not limited to: external data in Atlassian (e.g., support tickets), web data (if search is enabled), third-party ‘connectors’, etc.
The victim asks Rovo to organize their Jira tickets
The injection manipulates Rovo to submit Jira tickets and Confluence documents to the attacker’s website
Rovo's URL retrieval tool is insecure: there are no protections against opening a URL that has been dynamically created by the agent . Here, Rovo is manipulated to append sensitive data to an attacker's URL. When Rovo calls the insecure tool to open the URL, the attacker's site logs the request, including the appended sensitive data.
Note: This attack succeeds even if an organization has disabled web search for Rovo. This is because the web search setting fails to remove the tool for opening the search results.
If the user returns to the chat later, they see the agent's suggested ticket updates, but no evidence of the attack.
The attacker views the victim’s tickets and document contents in their website logs
The prompt injection can exfiltrate any data the agent can access in Atlassian, including any data the agent can access via ‘connectors’.
Atlassian Rovo also renders Markdown images from AI outputs. Insecure Markdown image rendering is a well-known vector for data exfiltration via indirect prompt injection.
To see what a full attack chain looks like for insecure Markdown image rendering, here are some examples from our other research:
PromptArmor disclosed the vulnerabilities covered in this article to Atlassian on May 23rd. Atlassian assigned a case number and expressed thanks, but after multiple follow-ups by PromptArmor over more than two months, Atlassian has made no further communication, and Rovo remains vulnerable as of the release of this article.
PromptArmor continuously monitors across your portfolio of third party AI in vendors, skills, plugins, connectors, MCP servers, models and more.
We detect vulnerabilities and changes like this, surfacing risk before it becomes an incident.
Assess and monitor risk from AI in vendors with novel intelligence on emerging threats.
扫码直达文章详情