cbcvebase.
CVE-2022-43781
published 2022-11-17

CVE-2022-43781: There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their…

PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
98.08%
99.9th percentile
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

Affected

26 ranges· showing 25
VendorProductVersion rangeFixed in
atlassianbitbucket>= 7.0.0 < 7.6.197.6.19
atlassianbitbucket>= 7.18.0 < 7.21.67.21.6
atlassianbitbucket>= 7.22.0 < 8.0.58.0.5
atlassianbitbucket>= 7.7.0 < 7.17.127.17.12
atlassianbitbucket>= 8.1.0 < 8.1.58.1.5
atlassianbitbucket>= 8.2.0 < 8.2.48.2.4
atlassianbitbucket>= 8.3.0 < 8.3.38.3.3
atlassianbitbucket>= 8.4.0 < 8.4.28.4.2
atlassianbitbucket_data_center——
atlassianbitbucket_data_center——
atlassianbitbucket_data_center——
atlassianbitbucket_data_center——
atlassianbitbucket_data_center——
atlassianbitbucket_data_center——
atlassianbitbucket_data_center——
atlassianbitbucket_data_center——
atlassianbitbucket_data_center——
atlassianbitbucket_server——
atlassianbitbucket_server——
atlassianbitbucket_server——
atlassianbitbucket_server——
atlassianbitbucket_server——
atlassianbitbucket_server——
atlassianbitbucket_server——
atlassianbitbucket_server——

Detection & IOCsextracted from sources · hover to see the quote

commandGIT_EXTERNAL_DIFF↗
  • →Monitor for the `GIT_EXTERNAL_DIFF` environment variable being set in processes spawned by the Bitbucket application (atlbitbucket user), which is the injection vector for RCE. ↗
  • →Alert on unexpected child processes spawned by the `atlbitbucket` user, especially following a diff operation, as the payload executes when Bitbucket is coerced into generating a diff. ↗
  • →Inspect Bitbucket user account names for embedded null characters or environment variable syntax (e.g. `VAR=value\x00`), which is the injection delimiter used by this exploit. ↗
  • ·Exploitation requires the attacker to have permission to control their username; admin-level credentials are needed to change a username via the module, but unauthenticated exploitation is possible if 'Allow public signup' is enabled. ↗
  • ·The RCE payload only triggers when Bitbucket is coerced into generating a diff — detections should account for this deferred execution pattern rather than triggering solely on username modification. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.