A security vulnerability was recently identified and fixed in Elements Connect. Here are the details about the issue, its impact and the analysis and actions taken.
Nature of the issue
The vulnerability was present since the version of Elements Connect for Jira Cloud published on (FreeMarker in queries).
An SQL injection vulnerability was identified in the handling of FreeMarker templates. This vulnerability allowed attackers to reads arbitrary data from the organization's connected external database.
This vulnerability has been rated as critical, according to the scale published on the Common Vulnerability Scoring System (CVSS).
The vulnerability was brought to our notice by the Bug Bounty Program on and fixed on
Impact
This vulnerability affected Database connected fields whose query was configured to use FreeMarker and included the end user's search input (${userInput}). In that specific configuration, a user filling in the field — including a user with limited permissions — could enter specially crafted text that caused the query to return more information than the field was designed to expose. In practice, this could allow reading of data held in the same external database that the datasource connects to, potentially beyond the scope originally intended for the field.
The issue was limited to reading data: the connections used by Elements Connect are read-only, so no information could be modified, added, or deleted, and the exposure was confined to the external database reachable through that datasource's own credentials — no other Elements Connect or Jira data was affected. Fields that do not use FreeMarker, and FreeMarker queries that do not include the user's input, were never impacted.
Because of the nature of this vulnerability, we are unable to confirm whether it was ever exploited in a production environment.
Analysis and actions taken
We have changed how ${userInput} is processed by FreeMarker and executed in SQL queries, eliminating the possibility of SQL injection.
Deployment of the fixed version was conducted by following the usual CI procedure.
Conclusion
This fix is now live and ensures that Elements Connect Cloud remains secure.
No action is required from customers, but we encourage all users to keep their applications up to date and report any suspicious behavior.
We want you to know that we take this issue very seriously. We are conducting a thorough review of our internal processes to ensure this does not occur again for our customers.
If you have any questions, please feel free to raise a support request at support.elements-apps.com referencing "ECC-4916".