Is Atlassian Bitbucket Server or Data Center patched against CVE-2022-36804?

Sends a crafted curl request to execute a command on the remote host and read the /etc/passwd file.
This week, we are releasing 1 TTP:
  • Is Atlassian Bitbucket Server or Data Center patched against CVE-2022-36804?

Is Atlassian Bitbucket Server or Data Center patched against CVE-2022-36804?

CVE-2022-36804 is a command injection vulnerability affecting multiple API endpoints. The vulnerability allows unauthenticated arbitrary code execution on Atlassian Bitbucket Server and Data Center when read permission on a public or private Bitbucket repository is enabled.

Per Atlassian, Bitbucket Data Center is a self-managed solution that provides source code collaboration for professional teams of any size, across any distance.

Atlassian Bitbucket Server and Data Center versions after 6.10.17 including 7.0.0 and newer are affected. The severity level of this vulnerability is rated critical by Atlassian and has a CVSS3 score of 9.8. This vulnerability is easily exploitable, reliable, and has a low risk of service disruption.

Testing

Execute Operator’s CVE-2022-36804 TTP on each server running Atlassian Bitbucket Server or Data Center in your environment to test if you are vulnerable.

The TTP is configured to send a crafted GET request to localhost using the default port 7990. Values of the PROJECT and REPO variables must be updated in the TTP file to reflect your environment. The TTP runs the shell command, cat /etc/passwd, to read the passwd file on the target server and then parses the output to confirm the exploit was successful.

Remediation

To remediate this vulnerability, update each affected product installation to a patched version. Check the Bitbucket Server and Data Center Advisory for version information.

Atlassian recommends the following temporary remediation:

"If you’re unable to upgrade Bitbucket, a temporary mitigation step is to turn off public repositories globally by setting feature.public.access=false as this will change this attack vector from an unauthorized attack to an authorized attack. This can not be considered a complete mitigation as an attacker with a user account could still succeed. Blocking network access to Bitbucket may also function as a temporary stop-gap solution."

Check out “Is Atlassian Bitbucket Server and Data Center patched against CVE-2022-36804?” on the Prelude chains website.

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current

See the latest kill chain and TTP Releases: https://chains.prelude.org

See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu

Reddit: https://www.reddit.com/r/preludeorg/

Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg

Read our blog: https://feed.prelude.org

Watch our live streams: https://www.twitch.tv/preludeorg

Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: https://twitter.com/privateducky

Alex: https://twitter.com/khyberspache

Octavia: https://twitter.com/VVX7

Waseem: https://twitter.com/gerbsec

Sam: https://twitter.com/heavenraiza

Source: https://feed.prelude.org
Read more

Execute this chain

Download Operator (1.7.1)
Learn about Operator

TTPs

Is Atlassian Bitbucket Server or Data Center patched against CVE-2022-36804?

Tactics