CVE-2019-11580: Atlassian Crowd and Crowd Data Center Remote Code Execution Vulnerability

CVE-2019-11580 is a remote code execution vulnerability in Atlassian Crowd and Crowd Data Center. It stems from a development plugin named pdkinstall that was incorrectly left enabled in release builds, giving attackers a path to run code on affected servers. This matters because Crowd often sits at the center of identity and access management; successful exploitation can lead to full server compromise and has been tied to ransomware activity. Confirm all version and patch details against the vendor advisory.

How it works

The core issue is that a plugin intended only for development remained active in production releases of Crowd and Crowd Data Center. When such a component is reachable, an unauthenticated or low-privilege attacker can abuse its installation or configuration interfaces to introduce and execute arbitrary code on the host. The result is remote code execution under the privileges of the Crowd process. Exact request formats and preconditions are not detailed here; treat any publicly exposed Crowd instance as potentially abusable until you verify it is patched and the plugin is disabled. Because the weakness is essentially an unintended attack surface left in a release build, the practical abuse path is straightforward once an attacker can reach the affected endpoint.

Am I affected? How to find it in your systems

Atlassian Crowd and Crowd Data Center are typically deployed as standalone identity servers or clustered data-center nodes that provide single sign-on, directory synchronization, and application access control. They commonly run on Linux or Windows hosts inside corporate networks or in cloud VPCs, often behind reverse proxies but sometimes exposed for remote authentication flows.

• Inventory every host or container running Crowd or Crowd Data Center software; check package managers, service lists, and configuration management databases for the product name.
• Record the installed version and build and compare it directly to the fixed versions listed in the official Atlassian advisory; do not rely on secondary sources.
• Inspect Crowd’s plugin or add-on management interface (or the corresponding filesystem directories) for the presence of the pdkinstall development plugin; its existence in a production instance is a strong indicator of residual risk.
• Review access logs, reverse-proxy logs, and Crowd’s own audit logs for unexpected requests to plugin-installation or administrative endpoints, especially from untrusted networks. Look for anomalous process creation or outbound connections originating from the Crowd service account after such requests.
• If you use vulnerability scanners, ensure their Atlassian Crowd checks are current and re-scan after any configuration change.

How to remediate

The primary action is to apply the updates published by Atlassian for Crowd and Crowd Data Center, following the vendor’s instructions exactly. CISA’s required action is the same: apply updates per vendor instructions. After patching:

• Verify that the pdkinstall plugin is no longer present or is explicitly disabled in the running configuration.
• Restart services only after confirming the new build is active, then re-check version strings and plugin lists.
• Restrict administrative and plugin-management interfaces to trusted management networks and require strong authentication.
• Apply least-privilege principles to the Crowd service account and ensure the host itself is hardened and monitored.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Segment Crowd servers so they are reachable only from required application tiers and administrative jump hosts; block direct internet access.
• Place a web application firewall or reverse-proxy rule in front of Crowd to deny requests that target plugin-installation or development endpoints; tune rules carefully to avoid breaking legitimate traffic.
• If the product allows it, disable or uninstall the pdkinstall plugin and any other development-only components immediately.
• Increase monitoring: alert on new process execution by the Crowd user, unexpected outbound connections, and any authentication or configuration changes. Retain logs for forensic review.
• Consider temporary read-only or maintenance modes if business processes allow, to limit writeable attack surface.

If your data may have been exposed

This vulnerability has been used in ransomware campaigns, so any unpatched Crowd instance that was reachable should be treated as potentially compromised. Isolate affected hosts, preserve volatile evidence, and begin incident-response procedures that include credential rotation, directory integrity checks, and review of downstream applications that trust Crowd for authentication. As a quick additional step, you can run a free exposure scan of your email addresses against known breach data sets to see whether related accounts already appear in public dumps.