junohea/cve-2022-36804Python exploit for CVE-2022-36804, enabling remote command execution and file transfer on vulnerable Bitbucket Server/Data Center via crafted archive requests.
This repository contains a Python exploit script for Atlassian Bitbucket Server/Data Center vulnerability CVE-2022-36804. The issue is a command-injection flaw in the Git archive flow, where crafted prefix parameters can be interpreted by the server and executed as shell commands.
CVE-2022-36804 is a Bitbucket Server/Data Center remote command execution vulnerability. It was caused by unsafe handling of the prefix value on the archive endpoint, allowing attacker-controlled data to reach a shell invocation through Git. The consequence is unauthenticated or authenticated command execution depending on the path and deployment model.
This script targets the vulnerable archive endpoint and uses a crafted request to trigger the injection.
This PoC is intended for affected Bitbucket Server/Data Center builds covered by Atlassian advisory for CVE-2022-36804. In practice, the vulnerable range includes older 7.x/8.x Bitbucket Server/Data Center releases before the fixed versions listed by Atlassian. It is not meant for patched or upgraded builds.
Use this only against systems you own or are explicitly authorized to test.
The script sends a request to:
/rest/api/latest/projects/{project}/repos/{repo}/archive
with a specially crafted prefix parameter that looks like:
ax%00--exec=`<command>`%00--remote=origin
The trick is to exploit the null-byte / Git command path so the server ends up executing a shell command from the archive request. The script wraps the command in gzip + base64 when needed so the output is returned compactly and decoded locally.
The script supports two main modes:
python cve-2022-36804_v5.py <url> <username> <password> -p <project> -r <repo> -c "whoami"
Options:
-c, --command: run a command--no-encode: send the raw command without gzip+base64 wrapping-p, --project: Bitbucket project key-r, --repo: Bitbucket repo slugpython cve-2022-36804_v5.py <url> <username> <password> -p <project> -r <repo> -f /path/to/local.bin -o /tmp/remote.bin
This reads a local file in chunks, base64-encodes each chunk, and uses the exploit to reconstruct it on the server at the target path.
requests.Session with basic auth.verify = False) to simplify testing against self-signed endpoints.This tool is for authorized security research and controlled testing only. Using it against systems you do not own or do not have permission to test is illegal and unethical.