Varonis Threat Labs identified a parameter-to-prompt (P2P) injection vulnerability in Atlassian's Rovo AI assistant, dubbed RovoBlast. The attack leveraged the 'rovoChatPrompt' URL parameter to inject attacker-controlled prompts directly into a user's AI session without requiring jailbreak or permission bypass. The flaw allowed the AI to autonomously access and exfiltrate data from multiple integrated enterprise systems including Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace, and SharePoint. The vulnerability exploited the AI's autonomous agent features and the ResearchAgent tool to pull internal data and push it externally in a single automated chain. Proof-of-concept demonstrations showed exfiltration of Confluence pages, Jira tickets, and SharePoint content containing personal data. Atlassian was notified and remediated the vulnerability prior to public disclosure.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive enterprise data across multiple integrated platforms such as Jira, Confluence, SharePoint, and others. The attack required only a single malicious link and no additional bypasses, potentially allowing attackers to exfiltrate confidential information including personal data. This poses a significant risk to organizational data confidentiality and privacy.

Atlassian has fixed the vulnerability prior to public disclosure. Organizations should ensure they have applied the official fix from Atlassian. Additionally, it is recommended to limit Rovo AI's access to only necessary systems, disconnect unused integrations, restrict sensitive areas such as legal, HR, and finance from AI access, and disable browsing or multi-step automation features if not actively used. Monitoring assistant activity logs for unusual behavior is also advised. Customers should follow security best practices to verify that content provided to Atlassian apps comes from trusted sources, as exploitation requires a user to provide untrusted prompt input.