CVE-2022-36804 PoC — Atlassian Bitbucket Server 安全漏洞

Source

https://github.com/devengpk/CVE-2022-36804

Associated Vulnerability

Title:Atlassian Bitbucket Server 安全漏洞 (CVE-2022-36804)
Description:Atlassian Bitbucket Server是澳大利亚Atlassian公司的一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。 Atlassian Bitbucket Server and Data Center存在安全漏洞，该漏洞源于允许对公共或私有Bitbucket库有读取权限的远程攻击者通过发送恶意的HTTP请求执行任意代码。以下产品及版本受到影响：7.0.0 至 7.6.17 之前版本，7.7.0 至 7.17.10 之前版本，7.18.0

Readme

# CVE-2022-36804
The Bitbucket Server and Bitbucket Data Center components have a command injection vulnerability, according to information recently discovered by the Sangfor security team. An attacker can submit malicious HTTP requests to execute arbitrary code and eventually get access to the server if they have read access to private or public Bitbucket repositories or access to public repositories with write access.

This repository contains payloads file and full POC for this vulnerability

File Snapshot


 [4.0K]  /data/pocs/29cbe4e942a166f58a695e07accd698053b6b5f1
├── [ 195]  payload.txt
└── [ 500]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!