Varonis Threat Labs has recently uncovered a significant security vulnerability in Rovo, Atlassian's enterprise AI assistant. This vulnerability, known as RovoBlast, allows attackers to inject malicious instructions into a user's AI session with a single click. The flaw stems from Rovo's reliance on externally supplied parameters, which it treats as trusted input without requiring jailbreaks or permission bypasses. Rovo integrates with multiple platforms, including Jira, Confluence, and Bitbucket, and its autonomous capabilities make it particularly vulnerable to the RovoBlast exploit.
The exploit utilizes a URL parameter called rovoChatPrompt to insert content directly into Rovo’s chat interface. This method of parameter-to-prompt injection had previously been identified in another context by Varonis researchers. In this case, attackers could exploit the vulnerability to access an organization's default settings without any alerts. By simply querying Rovo about the data it could access, researchers found that the AI could interact with a wide range of data sources, including Jira, Confluence, Slack, and more.
The real risk comes from the ResearchAgent, a feature in Rovo that can autonomously conduct web research and navigate different sites. Once an attacker seeds a prompt using a malicious link, Rovo can leak internal data to the web seamlessly, without requiring multiple requests or additional bypass steps. Varonis demonstrated this by exfiltrating data from Confluence, Jira, and SharePoint in proof-of-concept tests.
Upon discovering the vulnerability, Varonis promptly notified Atlassian, which addressed the issue before the public disclosure of the findings. Organizations are advised to limit Rovo's system access, disconnect unused integrations, and secure sensitive areas like legal and HR. Disabling unnecessary browsing or automation features and regularly monitoring assistant activity logs are also recommended to mitigate risks. Varonis presented their research findings at DEF CON 34, offering a technical write-up on the Varonis blog.