CVE-2022-36804 is a vulnerability in Atlassian Bitbucket
Published on August 25, 2022
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
Known Exploited Vulnerability
This Atlassian Bitbucket Server and Data Center Command Injection Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Multiple API endpoints of Atlassian Bitbucket Server and Data Center contain a command injection vulnerability where an attacker with access to a public Bitbucket repository, or with read permissions to a private one, can execute code by sending a malicious HTTP request.
The following remediation steps are recommended / required by October 21, 2022: Apply updates per vendor instructions.
Vulnerability Analysis
CVE-2022-36804 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 2.8 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2022-36804 has been classified to as a Shell injection vulnerability or weakness.
What is an Argument Injection Vulnerability?
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CVE-2022-36804 has been classified to as an Argument Injection vulnerability or weakness.
Products Associated with CVE-2022-36804
You can be notified by stack.watch whenever vulnerabilities like CVE-2022-36804 are published in these products:
What versions of Bitbucket are vulnerable to CVE-2022-36804?
-
Atlassian Bitbucket Version 8.3.0
-
Atlassian Bitbucket Version 8.2.0 Fixed in Version 8.2.2
-
Atlassian Bitbucket Version 8.1.0 Fixed in Version 8.1.3
-
Atlassian Bitbucket Version 8.0.0 Fixed in Version 8.0.3
-
Atlassian Bitbucket Version 7.0.0 Fixed in Version 7.6.17
-
Atlassian Bitbucket Version 7.7.0 Fixed in Version 7.17.10
-
Atlassian Bitbucket Version 7.18.0 Fixed in Version 7.21.4