Critical command injection vulnerability discovered in Atlassian Bitbucket Server and Data Center

guest · Sep 3, 2022

Update now to protect against flaw
by Jessica Haworth @JesscaHaworth - August 26, 2022

A critical command injection vulnerability in a Bitbucket product could allow an attacker to execute arbitrary code, researchers warn.
Bitbucket is a Git-based source code repository hosting service owned by Atlassian.

The flaw, tracked as CVE-2022-36804, is a command injection vulnerability in multiple API endpoints of Bitbucket Server and Data Center.
Click to expand...

This vulnerability could allow remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request.

It was discovered by researcher ‘The Grand Pew’, who reported it through Bugcrowd’s bug bounty program.
Click to expand...

Update now
All versions of the Server and Data Center released after 6.10.17 are affected, meaning that all instances running any versions between 7.0.0 and 8.3.0 inclusive are vulnerable.

A blog post reads: “A temporary mitigation step is to turn off public repositories globally by setting feature.public.access=false as this will change this attack vector from an unauthorized attack to an authorized attack.”
Click to expand...

guest · Aug 27, 2022

A Vulnerability in Atlassian Bitbucket Server and Data Center Could Allow For Remote Code Execution
MS-ISAC ADVISORY NUMBER: 2022-0107

DATE(S) ISSUED: 08/27/2022
OVERVIEW:
A Vulnerability has been discovered in Atlassian Bitbucket Server and Data Center which could allow for remote code execution. Bitbucket is a Git-based source code repository hosting service owned by Atlassian. Successful exploitation could allow the attacker to execute remote code in context of the application. Depending on the permission associated with the application running the exploit, an attacker could then install programs; view, change, or delete data.
Click to expand...

THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

Bitbucket Server and Data Center versions prior to 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.2, 8.2.2, 8.3.1

Click to expand...

TECHNICAL SUMMARY:
A Vulnerability has been discovered in Atlassian Bitbucket Server and Data Center which could allow for remote code execution. An attacker with read permissions to a public or private Bitbucket repository can execute arbitrary code by sending a malicious HTTP request. Successful exploitation could allow the attacker to execute remote code in context of the application.
Tactic: Execution (TA0002):
Technique: Native API (T1106)
Click to expand...

guest · Nov 18, 2022

Atlassian fixes critical command injection bug in Bitbucket Server
By Bill Toulas @billtoulas - November 18, 2022

Atlassian has released updates to address critical-severity updates in its centralized identity management platform, Crowd Server and Data Center, and in Bitbucket Server and Data Center, the company's solution for Git repository management.

Both security vulnerabilities received a severity rating of 9 out of 10 (calculated by Atlassian) and affect multiple versions of the products.
Click to expand...

Misconfiguration in Crowd
Rated critical, the issue in Crowd Server and Data Center is tracked as CVE-2022-43782 and is a misconfiguration that allows an attacker to bypass password checks when authenticating as the Crowd app and to call privileged API endpoints.

"This would allow the attacker to call privileged endpoints in Crowd's REST API under the user management path," Atlassian notes in a security advisory.
Bitbucket flaw details
The flaw affecting Bitbucket Server and Data Center was introduced in version 7.0 of the product and is identified as CVE-2022-43781. It is a command injection vulnerability that lets an attacker with permission to control their username to gain code execution on the target system under certain conditions.
Click to expand...

The security advisory notes that ADMIN and SYS_ADMIN users can still exploit the flaw under this configuration, so it should be treated as a temporary mitigation measure.
Click to expand...

Log in or Sign up

Critical command injection vulnerability discovered in Atlassian Bitbucket Server and Data Center

guest Guest

guest Guest

guest Guest

Log in or Sign up

Critical command injection vulnerability discovered in Atlassian Bitbucket Server and Data Center

guest Guest

guest Guest

guest Guest

Useful Searches