CVE-2022-36804 Atlassian Bitbucket Server and Data Center Command Injection
Remote attackers with read access can execute arbitrary code via malicious HTTP requests in Atlassian Bitbucket Server and Data Center.
- Exploited in the wild
- Since 30 Sep 2022
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36804?
CVE-2022-36804 is a high-severity command injection vulnerability in Atlassian Bitbucket Data Center, published on 25 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
Which versions are affected by CVE-2022-36804?
It affects 1 product.
Products include Atlassian Bitbucket.
How do I fix CVE-2022-36804?
No fix has been published for CVE-2022-36804 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Oct 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-36804 being exploited?
Yes. Attackers have exploited CVE-2022-36804 in the wild since at least 30 Sep 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 19 proofs of concept on GitHub.
Other vulnerabilities in Atlassian Bitbucket Data Center
Sources
Also known as GHSA-vcm2-j8f4-m7fj.