A security vulnerability was recently identified and fixed in Elements Connect. Here are the details about the issue, its impact and the analysis and actions taken.
Nature of the issue
The vulnerability was present since the start of Elements Connect for Jira Cloud.
When a Jira administrator saved a Database datasource, the Server (host) field was not checked for the characters that a JDBC driver treats as the start of connection options. An administrator could therefore append arbitrary driver options to the connection, and cause the Elements Connect backend component that opens database connections to connect to a database server under their control. Some of those driver options instruct the driver to read local files and to fetch URLs, which made it possible to read information from inside that backend component.
This vulnerability has been rated 8.2 according to the scale published by the Common Vulnerability Scoring System (CVSS). The vulnerability was brought to our attention through the Bug Bounty Program on . An initial mitigation was deployed on , and a complete fix was deployed on .
Impact
Exploiting this vulnerability required Jira administrator permissions on the Jira instance, since only an administrator can create or edit a datasource. It could not be triggered by a regular Jira user, nor by a Jira Service Management customer.
What an administrator could reach was limited to the internal component that opens datasource connections:
-
No Jira data and no Elements Connect configuration data was exposed. That component does not hold either, and it has no access to the encryption key that protects stored datasource credentials, so the connection details (server, login, password) that customers have saved in Elements Connect remained encrypted and unusable.
-
No other customer's external database could be read. The component connects to a customer's database only with that customer's own stored credentials, which remained encrypted as described above.
-
The information that could be read was internal to our own infrastructure: the component's own configuration, and credentials belonging to internal Elements components. Those credentials have since been rotated.
-
The issue did not allow any data to be modified, added or deleted in a customer's external database: the connections Elements Connect uses are read-only.
The vulnerability was found and reported by a security researcher through our Bug Bounty Program. As part of the analysis, we reviewed every Database datasource configuration stored in production and the only configurations containing these driver options were the ones created by that researcher on their own test instance. No customer configuration was affected.
Analysis and actions taken
The connection details of a datasource are now validated where the database connection is actually built, rather than only when the datasource is saved. This closes two gaps at once: a configuration saved before the fix can no longer be used either, and the check cannot be skipped by any other code path.
The validation itself was changed in nature. It used to be a list of forbidden driver option names, which can never be complete; it now accepts only what a server address and a database name legitimately look like, and rejects the characters that could introduce driver options in the first place.
In addition:
-
Elements Connect now refuses, on the server side, a datasource pointing at an internal or private network address.
-
The database drivers are explicitly configured to refuse the local-file and URL-fetching behaviours that this vulnerability relied on, as a second layer of defence.
-
The permissions and the credentials of the affected internal component were reviewed, reduced where possible, and rotated.
Conclusion
This fix is now live and ensures that Elements Connect Cloud remains secure.
No action is required from customers, but we encourage all users to keep their applications up to date and report any suspicious behavior.
We want you to know that we take this issue very seriously. We are conducting a thorough review of our internal processes to ensure this does not occur again for our customers.
If you have any questions, please feel free to raise a support request at support.elements-apps.com referencing "ECC-4983".