CVE-2022-26137: 
Bamboo 脆弱性の分析と軽減

A critical vulnerability (CVE-2022-26137) discovered in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses. The vulnerability affects multiple Atlassian Server and Data Center products including Bamboo, Bitbucket, Confluence, Crowd, Fisheye, Crucible, Jira, and Jira Service Management. Atlassian Cloud instances are not affected as patches have been deployed (Atlassian Advisory).

The vulnerability exists in how Atlassian products implement Servlet Filters, which are used to intercept and process HTTP requests before they reach backend resources. A remote attacker can exploit this by sending specially crafted HTTP requests that cause additional Servlet Filters to be invoked during request/response processing. The most significant confirmed security issue is a cross-origin resource sharing (CORS) bypass, where an attacker can invoke the Servlet Filter used to respond to CORS requests. The vulnerability has been assigned a CVSS score of 9.4 (Critical) (Atlassian Advisory, Arctic Wolf).

The primary impact is that an attacker who can trick a user into requesting a malicious URL can access the vulnerable application with the victim's permissions through CORS bypass. The vulnerability could potentially lead to authentication bypass and cross-site scripting (XSS) attacks depending on which filters are used by each application (Atlassian Advisory).

Atlassian has released security patches for all affected products and recommends upgrading to the fixed versions. There are no known workarounds for this vulnerability. Organizations should update their Atlassian products to the latest patched versions as specified in the security advisory. For example, Bamboo Server users should upgrade to versions 7.2.9 or later, Bitbucket Server to 7.6.16 or later, and Confluence Server to 7.4.17 or later (Atlassian Advisory).