CVE-2022-36804 PoC — Atlassian Bitbucket Server 安全漏洞

Source

https://github.com/SystemVll/CVE-2022-36804

Associated Vulnerability

Title:Atlassian Bitbucket Server 安全漏洞 (CVE-2022-36804)
Description:Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Description

A loader for bitbucket 2022 rce (cve-2022-36804)

Readme

# CVE-2022-36804 (Bitbucket RCE 2022)

This repo is part of the ***hgrab-framework***

### dork
`title: "<title>Public Repositories - Bitbucket</title>"`

### Affected product
    - Bitbucket Server and Data Center 7.6 prior to 7.6.17
    - Bitbucket Server and Data Center 7.17 prior to 7.17.10
    - Bitbucket Server and Data Center 7.21 prior to 7.21.4
    - Bitbucket Server and Data Center 8.0 prior to 8.0.3
    - Bitbucket Server and Data Center 8.1 prior to 8.1.3
    - Bitbucket Server and Data Center 8.2 prior to 8.2.2
    - Bitbucket Server and Data Center 8.3 prior to 8.3.1

### Installation
Install the app on the server
```sh
user@domain:~# git clone https://github.com/SystemVll/CVE-2022-36804.git
user@domain:~# cd ./CVE-2022-36804/
user@domain:~# python3 main.py <list.txt> <command>
```

The list file must contain the targets servers with this format `<http-https>://<target>:<port>`

![image](https://user-images.githubusercontent.com/69421356/192326094-8005846a-f67d-4206-a436-551ee092e920.png)

File Snapshot


 [4.0K]  /data/pocs/bb3bf6c2391fa409d5c3dd7a4ea06ad19cbce197
├── [ 11K]  LICENSE
├── [3.8K]  main.py
└── [1018]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!