h3. Issue Summary
Bitbucket Data Center had a path traversal vulnerability in the Data Center migration tool. A remote attacker with authenticated user with admin permissions can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Bitbucket Data Center. Bitbucket Server versions without a Data Center license are not vulnerable to this vulnerability.
Affected versions of Bitbucket Data Center:
h3. What You Need to Do
Atlassian recommends that you upgrade to the latest version. For a full description of the latest version ofĀ Bitbucket Data Center, see theĀ [release notes|https://confluence.atlassian.com/bitbucketserver/bitbucket-server-6-1-release-notes-966687591.html].Ā You can download the latest version ofĀ Bitbucket Data CenterĀ from theĀ [download centre.|https://www.atlassian.com/software/bitbucket/download/data-center]
Upgrade Bitbucket Data CenterĀ to version 6.1.2 or higher.
If you are runningĀ Bitbucket Data Center 5.13.xĀ andĀ cannot upgrade to 6.1.2Ā Ā thenĀ upgrade to version 5.13.6.
If you are runningĀ Bitbucket Data Center 5.14.xĀ andĀ cannot upgrade to 6.1.2Ā thenĀ upgrade to version 5.14.4.
If you are runningĀ Bitbucket Data Center 5.15.xĀ andĀ cannot upgrade to 6.1.2Ā thenĀ upgrade to version 5.15.3.
If you are runningĀ Bitbucket Data Center 5.16.xĀ andĀ cannot upgrade to 6.1.2Ā thenĀ upgrade to version 5.16.3.
If you are runningĀ Bitbucket Data Center 6.0.xĀ andĀ cannot upgrade to 6.1.2Ā thenĀ upgrade to version 6.0.3.
h3. Mitigation
The import functionality can be disabled via a feature flag, which would mitigate this vulnerability. This can be done by setting the propertyĀ {{feature.data.center.migration.import=false}}Ā inĀ {{bitbucket.properties}}. Note that the export functionality would still work in this case.Ā Bitbucket Server must then be restarted for changes to become effective.
If an import task still needs to be run, enable the feature on an isolated cluster node (inaccessible by users and admins but still connected to the cluster and accessible by sysadmins) with a node-localĀ {{bitbucket.properties}}Ā file where the propertyĀ {{feature.data.center.migration.import=true}}Ā is set. Imports can then be started by talking to this node directly while it would still be disabled on other nodes.
For additional details, see the full advisory: