CVE-2022-36804 PoC — Atlassian Bitbucket Server 安全漏洞

Source

https://github.com/SystemVll/CVE-2022-36804

Associated Vulnerability

Title:Atlassian Bitbucket Server 安全漏洞 (CVE-2022-36804)
Description:Atlassian Bitbucket Server是澳大利亚Atlassian公司的一款Git代码托管解决方案。该方案能够管理并审查代码，具有差异视图、JIRA集成和构建集成等功能。 Atlassian Bitbucket Server and Data Center存在安全漏洞，该漏洞源于允许对公共或私有Bitbucket库有读取权限的远程攻击者通过发送恶意的HTTP请求执行任意代码。以下产品及版本受到影响：7.0.0 至 7.6.17 之前版本，7.7.0 至 7.17.10 之前版本，7.18.0

Description

A loader for bitbucket 2022 rce (cve-2022-36804)

Readme

# CVE-2022-36804 (Bitbucket RCE 2022)

This repo is part of the ***hgrab-framework***

### dork
`title: "<title>Public Repositories - Bitbucket</title>"`

### Affected product
    - Bitbucket Server and Data Center 7.6 prior to 7.6.17
    - Bitbucket Server and Data Center 7.17 prior to 7.17.10
    - Bitbucket Server and Data Center 7.21 prior to 7.21.4
    - Bitbucket Server and Data Center 8.0 prior to 8.0.3
    - Bitbucket Server and Data Center 8.1 prior to 8.1.3
    - Bitbucket Server and Data Center 8.2 prior to 8.2.2
    - Bitbucket Server and Data Center 8.3 prior to 8.3.1

### Installation
Install the app on the server
```sh
user@domain:~# git clone https://github.com/SystemVll/CVE-2022-36804.git
user@domain:~# cd ./CVE-2022-36804/
user@domain:~# python3 main.py <list.txt> <command>
```

The list file must contain the targets servers with this format `<http-https>://<target>:<port>`

![image](https://user-images.githubusercontent.com/69421356/192326094-8005846a-f67d-4206-a436-551ee092e920.png)

File Snapshot


 [4.0K]  /data/pocs/bb3bf6c2391fa409d5c3dd7a4ea06ad19cbce197
├── [ 11K]  LICENSE
├── [3.8K]  main.py
└── [1018]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!