Context jwt vulnarbility

Jira Development Jira Cloud
, ,
1

Following the steps from this article: Action required: Atlassian Connect vulnerability allows bypass of app qsh verification via context JWTs

“authentication”:
“type”: “jwt”

I did this:

  • In atlassian-connect.json:
    “apiMigrations”:
    “context-qsh”: true,
  • In the pom.xml:
    <atlassian-connect-spring-boot.version>2.1.4</atlassian-connect-spring-boot.version>

And I started to get this:

error
error1850×1055 68.2 KB

2

Hi @Svetoslav,

the error suggests you are using an older version of Spring Boot, perhaps 2.2.1.RELEASE?

I would suggest that you upgrade to Spring Boot 2.4.2, considering the open issue we have against 2.4.3 or later.
https://ecosystem.atlassian.net/browse/ACSPRING-125

3 Likes
3

Thanks, Einar!
The Spring Booot version was 2.2.2.RELEASE. Now after I upgrade it to 2.4.2 everything works fine.