CVE-2022-36804 PoC — Atlassian Bitbucket Server 安全漏洞

Source

https://github.com/JRandomSage/CVE-2022-36804-MASS-RCE

Associated Vulnerability

Title:Atlassian Bitbucket Server 安全漏洞 (CVE-2022-36804)
Description:Atlassian Bitbucket Server是澳大利亚Atlassian公司的一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。 Atlassian Bitbucket Server and Data Center存在安全漏洞，该漏洞源于允许对公共或私有Bitbucket库有读取权限的远程攻击者通过发送恶意的HTTP请求执行任意代码。以下产品及版本受到影响：7.0.0 至 7.6.17 之前版本，7.7.0 至 7.17.10 之前版本，7.18.0

Description

A critical vulnerability (CVE-2022-36804) in Atlassian Bitbucket Server and Data Center could be exploited by unauthorized attackers to execute malicious code on vulnerable instances.

Readme

# CVE-2022-36804-POC
A critical vulnerability (CVE-2022-36804) in Atlassian Bitbucket Server and Data Center could be exploited by unauthorized attackers to execute malicious code on vulnerable instances.


# affected versions
All versions of Bitbucket Server and Data Center released before versions 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.2, 8.2.2, and 8.3.1 are vulnerable


# POC:
![POC](/poc.jpg)


# the poc is written in python with multi functionality(multi threading, list of ips, light weight, interactive shell...)
this upload comes with list of servers(mostly vulnerable)


# as of writting this there isnt any public poc for this vulnerability

# use at your own risk there is no way to avoid abuse: https://satoshidisk.com/pay/CGMSap


[![Hits](https://hits.seeyoufarm.com/api/count/incr/badge.svg?url=https%3A%2F%2Fgithub.com%2FCEOrbey%2FCVE-2022-36804-POC&count_bg=%2379C83D&title_bg=%23555555&icon=&icon_color=%23E7E7E7&title=RCE&edge_flat=false)](https://hits.seeyoufarm.com)

File Snapshot


 [4.0K]  /data/pocs/a2f58d5fe189f3ab2281dad12d6a87927de7b38b
├── [ 162]  CVE-2022-36804-mass.py
├── [214K]  poc.jpg
└── [ 990]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!