CVE-2019-11580

What is Atlassian Crowd?

Atlassian Crowd is a centralized identity management and single sign-on product used by organizations to unify authentication across Atlassian tools like Jira, Confluence, Bitbucket, and other enterprise applications. Because Crowd is trusted as an identity provider for potentially many downstream systems, gaining code execution on the Crowd server itself can expose credentials and session data for an entire suite of connected applications.

Overview

CVE-2019-11580 is a critical, unauthenticated remote code execution vulnerability in Atlassian Crowd and Crowd Data Center caused by a development/debugging plugin installer (pdkinstall) being mistakenly left enabled in production release builds. Because this installer endpoint accepts remotely-supplied plugins without requiring authentication, any attacker who can reach the Crowd web interface can upload a malicious plugin (packaged as a JAR/OBR file) that Crowd then loads and executes with the full privileges of the Crowd application — full remote code execution with no credentials needed.

Technical Details

The pdkinstall plugin is intended purely as a developer convenience for installing plugins during development and was never meant to ship in production. Its presence in release builds (CWE unspecified in the original advisory, but functionally an unauthenticated arbitrary file/code upload) means an attacker can send a crafted HTTP request containing a malicious plugin package to the pdkinstall servlet, which installs and immediately runs it inside Crowd's application server — a plugin can contain arbitrary Java code, giving the attacker command execution as the user running Crowd. No authentication, no user interaction, and low complexity are required, which is reflected in the maximum-severity CVSS score.

Discovery

Atlassian identified and disclosed the vulnerability itself, publishing a security advisory in May 2019 along with patched Crowd releases that remove the pdkinstall plugin from production builds.

Exploitation Context

This vulnerability has been broadly and persistently exploited since shortly after disclosure — its simplicity (a single unauthenticated HTTP request achieves full RCE) makes it an attractive target for both opportunistic cryptomining botnets, which have folded it into automated scan-and-exploit toolchains, and more targeted intrusions, including activity attributed to state-linked threat actors seeking initial access into enterprise environments. Its ransomwareUse: true KEV designation confirms it has also been used as an entry point in ransomware intrusion chains.

Remediation

1. Upgrade to a patched Crowd or Crowd Data Center release (3.0.5, 3.1.6, 3.2.8, 3.3.5, 3.4.4, or later) that removes the pdkinstall plugin from production builds.
2. If upgrading isn't immediately possible, manually locate and remove the pdkinstall plugin JAR from the Crowd installation directory as an interim mitigation.
3. Restrict network access to the Crowd web interface to trusted internal networks rather than exposing it directly to the internet.
4. Review Crowd server logs and installed plugins list for any unrecognized or unexpected plugins that may indicate prior exploitation.
5. Rotate credentials and session secrets for all applications federated through Crowd if compromise is suspected, given Crowd's role as a central identity provider.