CVE-2022-36804 is a command injection vulnerability affecting multiple API endpoints. The vulnerability allows unauthenticated arbitrary code execution on Atlassian Bitbucket Server and Data Center when read permission on a public or private Bitbucket repository is enabled.
Per Atlassian, Bitbucket Data Center is a self-managed solution that provides source code collaboration for professional teams of any size, across any distance.
Atlassian Bitbucket Server and Data Center versions after 6.10.17 including 7.0.0 and newer are affected. The severity level of this vulnerability is rated critical by Atlassian and has a CVSS3 score of 9.8. This vulnerability is easily exploitable, reliable, and has a low risk of service disruption.
Execute Operator’s CVE-2022-36804 TTP on each server running Atlassian Bitbucket Server or Data Center in your environment to test if you are vulnerable.
The TTP is configured to send a crafted GET request to localhost using the default port 7990. Values of the PROJECT
and REPO
variables must be updated in the TTP file to reflect your environment. The TTP runs the shell command, cat /etc/passwd
, to read the passwd
file on the target server and then parses the output to confirm the exploit was successful.
To remediate this vulnerability, update each affected product installation to a patched version. Check the Bitbucket Server and Data Center Advisory for version information.
Atlassian recommends the following temporary remediation:
"If you’re unable to upgrade Bitbucket, a temporary mitigation step is to turn off public repositories globally by setting feature.public.access=false
as this will change this attack vector from an unauthorized attack to an authorized attack. This can not be considered a complete mitigation as an attacker with a user account could still succeed. Blocking network access to Bitbucket may also function as a temporary stop-gap solution."
Check out “Is Atlassian Bitbucket Server and Data Center patched against CVE-2022-36804?” on the Prelude chains website.
Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:
Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org
See our open-source repositories: https://github.com/preludeorg
Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg
Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg
David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Octavia: https://twitter.com/VVX7
Waseem: https://twitter.com/gerbsec