CVE-2022-36804
published 2022-08-25CVE-2022-36804: Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version…
PriorityP195high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-10-21
Exploited in the wild
EPSS
99.08%
99.9th percentile
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| atlassian | bitbucket | — | — |
| atlassian | bitbucket | >= 7.0.0 < 7.6.17 | 7.6.17 |
| atlassian | bitbucket | >= 7.18.0 < 7.21.4 | 7.21.4 |
| atlassian | bitbucket | >= 7.7.0 < 7.17.10 | 7.17.10 |
| atlassian | bitbucket | >= 8.0.0 < 8.0.3 | 8.0.3 |
| atlassian | bitbucket | >= 8.1.0 < 8.1.3 | 8.1.3 |
| atlassian | bitbucket | >= 8.2.0 < 8.2.2 | 8.2.2 |
| atlassian | bitbucket_data_center | >= 7.0.0 < unspecified | unspecified |
| atlassian | bitbucket_data_center | >= 7.18.0 < unspecified | unspecified |
| atlassian | bitbucket_data_center | >= 7.7.0 < unspecified | unspecified |
| atlassian | bitbucket_data_center | >= 8.0.0 < unspecified | unspecified |
| atlassian | bitbucket_data_center | >= 8.1.0 < unspecified | unspecified |
| atlassian | bitbucket_data_center | >= 8.2.0 < unspecified | unspecified |
| atlassian | bitbucket_data_center | >= 8.3.0 < unspecified | unspecified |
| atlassian | bitbucket_data_center | >= unspecified < 7.6.17 | 7.6.17 |
| atlassian | bitbucket_data_center | >= unspecified < 7.17.10 | 7.17.10 |
| atlassian | bitbucket_data_center | >= unspecified < 7.21.4 | 7.21.4 |
| atlassian | bitbucket_data_center | >= unspecified < 8.0.3 | 8.0.3 |
| atlassian | bitbucket_data_center | >= unspecified < 8.1.3 | 8.1.3 |
| atlassian | bitbucket_data_center | >= unspecified < 8.2.2 | 8.2.2 |
| atlassian | bitbucket_data_center | >= unspecified < 8.3.1 | 8.3.1 |
| atlassian | bitbucket_server | >= 7.0.0 < unspecified | unspecified |
| atlassian | bitbucket_server | >= 7.18.0 < unspecified | unspecified |
| atlassian | bitbucket_server | >= 7.7.0 < unspecified | unspecified |
| atlassian | bitbucket_server | >= 8.0.0 < unspecified | unspecified |
Detection & IOCsextracted from sources · hover to see the quote
url/rest/api/latest/projects/{projectKey}/repos/{repositorySlug}/archive?prefix=ax%00--exec=%60{cmd}%60%00--remote=origin↗
commandprefix=ax%00--exec=%60{cmd}%60%00--remote=origin
snort
alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/rest/api/"; content:"/projects/"; distance:0; content:"/repos/"; distance:0; content:"|00|--"; distance:0; fast_pattern; reference:cve,2022-36804; reference:url,attackerkb.com/topics/iJIxJ6JUow/cve-2022-36804/rapid7-analysis; classtype:attempted-user; sid:2038930; rev:1; metadata:affected_product Atlassian, attack_target Client_Endpoint, created_at 2022_09_22, cve CVE_2022_36804, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_09_22;)
bytes
|00|--
- →Exploit requests are HTTP GET to /rest/api/latest/projects/{key}/repos/{slug}/archive with NULL bytes (%00) in query parameters to inject additional git-archive arguments. Look for %00 or literal null bytes in URI query strings targeting the /archive endpoint. ↗
- →A successful exploitation attempt causes the server to return HTTP 500 containing the string 'com.atlassian.bitbucket.scm.CommandFailedException' in the response body, which can be used as a detection signal. ↗
- →Attackers first enumerate public repositories via GET /rest/api/latest/repos or /repos?visibility=public before launching the archive endpoint exploit. Correlate these reconnaissance requests with subsequent /archive requests from the same source IP. ↗
- →The exploit payload pattern in the URI is: /rest/api/<version>/projects/<key>/repos/<slug>/archive with the prefix parameter containing ax followed by a null byte and --exec= and --remote=origin. Regex: /rest/api/[^/]+/projects/[^/]+/repos/[^/]+/archive.*prefix=.*%00 ↗
- →Shodan query for exposed Bitbucket instances: http.component:"BitBucket"
- ·The vulnerability requires at least read permissions to a public or private Bitbucket repository; it is not fully unauthenticated in all configurations, though public repositories require no credentials. ↗
- ·The Nuclei template iterates over all discovered repository slugs and project keys extracted from /rest/api/latest/repos before attempting exploitation, meaning a single scan may generate multiple /archive requests across different repo paths. ↗
- ·The Emerging Threats Snort rule (sid:2038930) is deployed at the perimeter and requires SSL decryption (SSLDecrypt) to detect exploitation over HTTPS.
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vcm2-j8f4-m7fj: Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7
ghsa_unreviewed·2022-08-26
CVE-2022-36804 [HIGH] CWE-77 GHSA-vcm2-j8f4-m7fj: Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
VulnCheck
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
vulncheck·2022·CVSS 8.8
CVE-2022-36804 [HIGH] CWE-78 Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.
Affected: Atlassian Bitbucket Server and Data Center
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://web.archive.org/web/20230318134256/https://unit42.paloaltonetworks.com/network-security-trends-aug-oct-2022/; https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-enterprise-applications-honeypot-
CISA
Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
cisa·2022-09-30·CVSS 8.8
CVE-2022-36804 [HIGH] CWE-78 Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Vulnerability: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability
Affected: Atlassian Bitbucket Server and Data Center
Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.
Required Action: Apply updates per vendor instructions.
Notes: https://jira.atlassian.com/browse/BSERV-13438; https://nvd.nist.gov/vuln/detail/CVE-2022-36804
Remediation Due Date: 2022-10-21
Suricata
ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt
suricata·2022-09-22·CVSS 8.8
CVE-2022-36804 [HIGH] ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt
ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt
Rule: alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Atlassian Bitbucket CVE-2022-36804 Exploit Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/rest/api/"; content:"/projects/"; distance:0; content:"/repos/"; distance:0; content:"|00|--"; distance:0; fast_pattern; reference:cve,2022-36804; reference:url,attackerkb.com/topics/iJIxJ6JUow/cve-2022-36804/rapid7-analysis; classtype:attempted-user; sid:2038930; rev:1; metadata:affected_product Atlassian, attack_target Client_Endpoint, created_at 2022_09_22, cve CVE_2022_36804, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022
Exploit-DB
Bitbucket v7.0.0 - RCE
exploitdb·2023-03-23·CVSS 8.8
CVE-2022-36804 [HIGH] Bitbucket v7.0.0 - RCE
Bitbucket v7.0.0 - RCE
---
# Exploit Title: Bitbucket v7.0.0 - RCE
# Date: 09-23-2022
# Exploit Author: khal4n1
# Vendor Homepage: https://github.com/khal4n1
# Tested on: Kali and ubuntu LTS 22.04
# CVE : cve-2022-36804
#****************************************************************#
#The following exploit is used to exploit a vulnerability present
#Atlassian Bitbucket Server and Data Center 7.0.0 before version
#7.6.17, from version 7.7.0 before version 7.17.10, from version
#7.18.0 before version 7.21.4, from version 8.0.0 before version
#8.0.3, from version 8.1.0 before version 8.1.3, and from version
#8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1
#Usage Example
# python3 mexploit.py --url http://127.0.0.1:7990 --cmd 'cat /etc/passwd'
# python3 mexploit.py --ur
Nuclei
Atlassian Bitbucket - Remote Command Injection
nuclei·CVSS 8.8
CVE-2022-36804 [HIGH] Atlassian Bitbucket - Remote Command Injection
Atlassian Bitbucket - Remote Command Injection
Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1.
Template:
id: CVE-2022-3680
Metasploit
Bitbucket Git Command Injection
metasploit
Bitbucket Git Command Injection
Bitbucket Git Command Injection
Various versions of Bitbucket Server and Data Center are vulnerable to an unauthenticated command injection vulnerability in multiple API endpoints. The `/rest/api/latest/projects/{projectKey}/repos/{repositorySlug}/archive` endpoint creates an archive of the repository, leveraging the `git-archive` command to do so. Supplying NULL bytes to the request enables the passing of additional arguments to the command, ultimately enabling execution of arbitrary commands.
Qualys
September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical.
blogs_qualys·2022-09-13·CVSS 5.6
[MEDIUM] September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
The September 2022 Microsoft Vulnerabilities Are Classified As Follows:
Notable Microsoft Vulnerabilities Patched
Zero-Day Vulnerabilities Addressed
Microsoft Important Vulnerability Highlights
Microsoft Edge | Last But Not Least
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Protection High-Rated Advisories from August to September 2022 Patch Tuesday Advisory
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
Rapid Response With Patch Management (PM)
Evaluate Vendor-Suggested Workarounds With Policy Compliance
Qualys This Month in Vulnerabilities and Patches Webinar Series
Join the Webinar This Month in Vulnerabilities & Patches
NEW & NOTEWORTHY
Qualys
September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical. | Qualy
blogs_qualys·2022-09-13·CVSS 5.6
[MEDIUM] September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical. | Qualy
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The September 2022 Microsoft Vulnerabilities Are Classified As Follows:
- Notable Microsoft Vulnerabilities Patched
- Zero-Day Vulnerabilities Addressed
- Microsoft Important Vulnerability Highlights
- Microsoft Edge | Last But Not Least
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Protection High-Rated Advisories from August to September 2022 Patch Tuesday Advisory
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
- Rapid Response With Patch Management (PM)
- Evaluate Vendor-Suggested Workarounds With Policy Compliance
- Qualys This Month in Vulnerabilities and Patches Webinar Series
- Join the Webinar This Month in Vulnerabilities & Patches
-
http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.htmlhttp://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.htmlhttps://jira.atlassian.com/browse/BSERV-13438http://packetstormsecurity.com/files/168470/Bitbucket-Git-Command-Injection.htmlhttp://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.htmlhttps://jira.atlassian.com/browse/BSERV-13438https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36804
2022-08-25
Published
2022-09-30
Added to CISA KEV
Exploited in the wild