Critical severity command injection vulnerability - CVE-2022-36804

h3. Command injection vulnerability through malicious HTTP requests

There is a command injection vulnerability in multiple API endpoints of Bitbucket Server and Data Center. An attacker with access to a public Bitbucket repository or with read permissions to a private one can execute arbitrary code by sending a malicious HTTP request.

All versions released after 6.10.17 including 7.0.0 and newer are affected, this means that all instances that are running any versions between 7.0.0 and 8.3.0 inclusive can be exploited by this vulnerability.

The full list of affected versions can be found in the “Affects Version/s:” field of this report.
h4. Affected versions:

All Bitbucket Server and Data Center versions from 7.0.0 to 8.3.0 inclusive.
h4. Fixed versions:
||Supported Version||Bug Fix Release||
|[Bitbucket Server and Data Center 7.6|https://confluence.atlassian.com/display/BitbucketServer/Bitbucket+Server+7.6+release+notes]|7.6.17 ([LTS|https://confluence.atlassian.com/enterprise/long-term-support-releases-948227420.html]) or newer|
|[Bitbucket Server and Data Center 7.17|https://confluence.atlassian.com/display/BitbucketServer/Bitbucket+Data+Center+and+Server+7.17+release+notes]|7.17.10 ([LTS|https://confluence.atlassian.com/enterprise/long-term-support-releases-948227420.html]) or newer|
|[Bitbucket Server and Data Center 7.21|https://confluence.atlassian.com/display/BitbucketServer/Bitbucket+Data+Center+and+Server+7.21+release+notes]|7.21.4 ([LTS|https://confluence.atlassian.com/enterprise/long-term-support-releases-948227420.html]) or newer|
|[Bitbucket Server and Data Center 8.0|https://confluence.atlassian.com/display/BitbucketServer/Bitbucket+Data+Center+and+Server+8.0+release+notes]|8.0.3 or newer|
|[Bitbucket Server and Data Center 8.1|https://confluence.atlassian.com/display/BitbucketServer/Bitbucket+Data+Center+and+Server+8.1+release+notes]|8.1.3 or newer|
|[Bitbucket Server and Data Center 8.2|https://confluence.atlassian.com/display/BitbucketServer/Bitbucket+Data+Center+and+Server+8.2+release+notes]|8.2.2 or newer|
|[Bitbucket Server and Data Center 8.3|https://confluence.atlassian.com/display/BitbucketServer/Bitbucket+Data+Center+and+Server+8.3+release+notes]|8.3.1 or newer|
h4. Bitbucket Mesh

If you have configured Bitbucket Mesh nodes, these will need to be updated with to the corresponding version of Mesh that includes the fix. To find the version of Mesh compatible with the Bitbucket Data Center version, please check the [+compatibility matrix+|https://confluence.atlassian.com/display/BitbucketServer/Bitbucket+Mesh+compatibility+matrix]. You can download the corresponding version from the [download centre|https://www.atlassian.com/software/bitbucket/download-mesh-archives].

For additional details, please see full advisory here: [https://confluence.atlassian.com/pages/viewpage.action?spaceKey=SECURITY&title=August+2022%3A+Atlassian+Security+Advisories+Overview]

This vulnerability was discovered by [@TheGrandPew|https://twitter.com/TheGrandPew] and reported via our Bug Bounty program.