Atlassian’s critical flaw turns eight enterprise products into one big security problem – Computerworld

Anyone can download these products and learn exactly where files live, he pointed out, and attackers also have the installation guide.

Additionally, configurations containing sensitive files increase an enterprise’s risk. “After years in production, a web root may collect configuration files, backups, and credentials nobody remembers putting there,” Dickson noted. “One readable secret becomes the first step in a much larger attack.”

Bottom line: The flaw “only” reads files, but the files it reads may open everything else, he said. “Patch, and if you cannot patch today, unplug it from the internet today.” Then, he advised, filter, search access logs for the published traversal pattern, and decode each line. If you find hits, assume the file was read. From there, rotate every credential, token, and key that could have lived in the web root.