Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bamboo | Atlassian | 5.0 (including) | 5.0 (including) |
| Bamboo | Atlassian | 5.0-beta1 (including) | 5.0-beta1 (including) |
| Bamboo | Atlassian | 5.0-beta2 (including) | 5.0-beta2 (including) |
| Bamboo | Atlassian | 5.0-beta3 (including) | 5.0-beta3 (including) |
| Bamboo | Atlassian | 5.0-rc1 (including) | 5.0-rc1 (including) |
| Bamboo | Atlassian | 5.0.1 (including) | 5.0.1 (including) |
| Bamboo | Atlassian | 5.1 (including) | 5.1 (including) |
| Bamboo | Atlassian | 5.1.1 (including) | 5.1.1 (including) |
| Bamboo | Atlassian | 5.2 (including) | 5.2 (including) |
| Bamboo | Atlassian | 5.2.1 (including) | 5.2.1 (including) |
| Bamboo | Atlassian | 5.2.2 (including) | 5.2.2 (including) |
| Bamboo | Atlassian | 5.3 (including) | 5.3 (including) |
| Bamboo | Atlassian | 5.4 (including) | 5.4 (including) |
| Bamboo | Atlassian | 5.4.1 (including) | 5.4.1 (including) |
| Bamboo | Atlassian | 5.4.2 (including) | 5.4.2 (including) |
| Bamboo | Atlassian | 5.5 (including) | 5.5 (including) |
| Bamboo | Atlassian | 5.6 (including) | 5.6 (including) |
| Bamboo | Atlassian | 5.6.1 (including) | 5.6.1 (including) |
| Bamboo | Atlassian | 5.6.2 (including) | 5.6.2 (including) |
| Bamboo | Atlassian | 5.7 (including) | 5.7 (including) |
| Bamboo | Atlassian | 5.7.1 (including) | 5.7.1 (including) |
| Bamboo | Atlassian | 5.7.2 (including) | 5.7.2 (including) |
| Bamboo | Atlassian | 5.8 (including) | 5.8 (including) |
| Bamboo | Atlassian | 5.8.1 (including) | 5.8.1 (including) |
| Bamboo | Atlassian | 5.8.2 (including) | 5.8.2 (including) |
| Bamboo | Atlassian | 5.8.5 (including) | 5.8.5 (including) |
| Bamboo | Atlassian | 5.9 (including) | 5.9 (including) |
| Bamboo | Atlassian | 5.9.1 (including) | 5.9.1 (including) |
| Bamboo | Atlassian | 5.9.2 (including) | 5.9.2 (including) |
| Bamboo | Atlassian | 5.9.3 (including) | 5.9.3 (including) |
| Bamboo | Atlassian | 5.9.4 (including) | 5.9.4 (including) |
| Bamboo | Atlassian | 5.9.7 (including) | 5.9.7 (including) |
| Bamboo | Atlassian | 5.11.3 (including) | 5.11.3 (including) |
| Bamboo | Atlassian | 5.12.0 (including) | 5.12.0 (including) |
| Bamboo | Atlassian | 5.12.1 (including) | 5.12.1 (including) |
| Bamboo | Atlassian | 5.12.2 (including) | 5.12.2 (including) |
| Bamboo | Atlassian | 5.12.4 (including) | 5.12.4 (including) |
| Bamboo | Atlassian | 5.12.5 (including) | 5.12.5 (including) |
| Bamboo | Atlassian | 5.13.0 (including) | 5.13.0 (including) |
| Bamboo | Atlassian | 5.13.1 (including) | 5.13.1 (including) |
| Bamboo | Atlassian | 5.13.2 (including) | 5.13.2 (including) |
| Bamboo | Atlassian | 5.14.0 (including) | 5.14.0 (including) |
| Bamboo | Atlassian | 5.14.1 (including) | 5.14.1 (including) |
| Bamboo | Atlassian | 5.14.2 (including) | 5.14.2 (including) |
| Bamboo | Atlassian | 5.14.3 (including) | 5.14.3 (including) |
| Bamboo | Atlassian | 5.14.4.1 (including) | 5.14.4.1 (including) |
| Bamboo | Atlassian | 5.14.5 (including) | 5.14.5 (including) |
| Bamboo | Atlassian | 5.15.0 (including) | 5.15.0 (including) |
| Bamboo | Atlassian | 5.15.2 (including) | 5.15.2 (including) |
| Bamboo | Atlassian | 5.15.3 (including) | 5.15.3 (including) |
| Bamboo | Atlassian | 5.15.4 (including) | 5.15.4 (including) |
| Bamboo | Atlassian | 5.15.5 (including) | 5.15.5 (including) |
| Bamboo | Atlassian | 6.0.0 (including) | 6.0.0 (including) |
Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user’s privileges and any permissions or other access-control specifications that apply to the resource. When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.