CVE-2022-36804 is a command injection vulnerability affecting multiple API endpoints. The vulnerability allows unauthenticated arbitrary code execution on Atlassian Bitbucket Server and Data Center when read permission on a public or private Bitbucket repository is enabled.
Per Atlassian, Bitbucket Data Center is a self-managed solution that provides source code collaboration for professional teams of any size, across any distance.
Atlassian Bitbucket Server and Data Center versions after 6.10.17 including 7.0.0 and newer are affected. The severity level of this vulnerability is rated critical by Atlassian and has a CVSS3 score of 9.8. This vulnerability is easily exploitable, reliable, and has a low risk of service disruption.
Execute Operator’s CVE-2022-36804 TTP on each server running Atlassian Bitbucket Server or Data Center in your environment to test if you are vulnerable.
This chain is configured to test if command execution is possible on the machine by attempting to run a simple
echo prelude. If that returns successfully we will attempt to install and execute a pneuma agent on the Atlassian Bitbucket Server.
Atlassian recommends that you upgrade your instance to one of the versions listed in the “Fixed Versions” section of this same page. For a full description of the latest version of Bitbucket Server and Data Center, see the release notes. You can download the latest version of Bitbucket from the download center.
Check out the TTP Is my Docker daemon vulnerable to privilege escalation? on the Prelude chains website.
Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:
Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org
See our open-source repositories: https://github.com/preludeorg
Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg