CVE-2022-26133 PoC — Atlassian Bitbucket Data Center 代码问题漏洞

Source

https://github.com/0xAbbarhSF/CVE-2022-26133

Associated Vulnerability

Title:Atlassian Bitbucket Data Center 代码问题漏洞 (CVE-2022-26133)
Description:Atlassian Bitbucket Data Center是澳大利亚Atlassian公司的Atlassian Bitbucket的数据中心版本。 Atlassian Bitbucket Data Center 存在安全漏洞，该漏洞源于容易受到 Java 反序列化攻击。未经身份验证的远程攻击者可以通过发送经特殊设计的请求来利用此漏洞，从而导致任意代码执行。以下产品和版本受到影响：5.14.x 及之后的所有 5.x 版本、所有 6.x 版本、7.6.14 之前的所有 7.x 版本、7.7.x 到 7.1

Description

CVE-2022-26133 Exploit

Readme

# CVE-2022-26133
<img src="https://github.com/0xAbbarhSF/CVE-2022-26133/blob/main/download.jpeg">

## Information

#### Description	
SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute arbitrary code via Java deserialization.

#### State ->	PUBLIC
#### Problem Type ->Deserialization of untrusted data


# Installation & Run
* git clone https://github.com/0xAbbarhSF/CVE-2022-26133
* cd CVE-2022-26133
* chmod +x *
* pip2 install parse
* python2 exploit.py

# Contact: - 🕊️ Twitter: [@0xAbbarhSF](https://twitter.com/0xAbbarhSF)
[![Tweet](https://img.shields.io/twitter/url/http/0xAbbarhSF.svg?style=social)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fdeveloper.twitter.com%2Fen%2Fdocs%2Ftwitter-for-websites%2Ftweet-button%2Foverview&ref_src=twsrc%5Etfw&text=CMS-Xploiter%20-%20Automated%20Pentest%20Recon%20Scanner%20%400xAbbarhSD&tw_p=tweetbutton&url=https%3A%2F%2Fgithub.com%2F0xAbbarhSF%)

File Snapshot


 [4.0K]  /data/pocs/26d55b0a0b95baa4dabc7c29adfc5c0c0a5b0ecf
├── [8.2K]  download.jpeg
├── [ 11K]  exploit.py
└── [1.1K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!