Is CVE-2022-36804 patched on Atlassian Bitbucket Server?

This week, we are taking a quick break from container exploits and releasing another CVE TTP:

• Is CVE-2022-36804 patched on Atlassian Bitbucket Server?

Is CVE-2022-36804 patched on Atlassian Bitbucket Server?

CVE-2022-36804 is a command injection vulnerability affecting multiple API endpoints. The vulnerability allows unauthenticated arbitrary code execution on Atlassian Bitbucket Server and Data Center when read permission on a public or private Bitbucket repository is enabled.

Per Atlassian, Bitbucket Data Center is a self-managed solution that provides source code collaboration for professional teams of any size, across any distance.

Atlassian Bitbucket Server and Data Center versions after 6.10.17 including 7.0.0 and newer are affected. The severity level of this vulnerability is rated critical by Atlassian and has a CVSS3 score of 9.8. This vulnerability is easily exploitable, reliable, and has a low risk of service disruption.

Testing

Execute Operator’s CVE-2022-36804 TTP on each server running Atlassian Bitbucket Server or Data Center in your environment to test if you are vulnerable.

This chain is configured to test if command execution is possible on the machine by attempting to run a simple echo prelude. If that returns successfully we will attempt to install and execute a pneuma agent on the Atlassian Bitbucket Server.

Remediation

Atlassian recommends that you upgrade your instance to one of the versions listed in the “Fixed Versions” section of this same page. For a full description of the latest version of Bitbucket Server and Data Center, see the release notes. You can download the latest version of Bitbucket from the download center.

Check out the TTP Is my Docker daemon vulnerable to privilege escalation? on the Prelude chains website.

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Octavia: https://twitter.com/VVX7
Waseem: https://twitter.com/gerbsec