CVE-2022-36804

Deeper analysis

CVE-2022-36804 is a command injection vulnerability affecting multiple API endpoints in Atlassian Bitbucket Server and Data Center. Impacted versions include 7.0.0 prior to 7.6.17, 7.7.0 prior to 7.17.10, 7.18.0 prior to 7.21.4, 8.0.0 prior to 8.0.3, 8.1.0 prior to 8.1.3, 8.2.0 prior to 8.2.2, and 8.3.0 prior to 8.3.1. The flaw, assigned CWE-78 and CWE-88, permits arbitrary code execution when an attacker supplies crafted input to the affected endpoints.

An attacker who already possesses read access to any public or private repository can exploit the issue by sending a single malicious HTTP request. Successful exploitation grants the ability to run arbitrary commands on the Bitbucket server with the privileges of the application process, resulting in full confidentiality, integrity, and availability impact as reflected in the CVSS 8.8 score.

Publicly available references include the Atlassian Jira issue BSERV-13438, which documents the affected releases and the corrected versions, as well as multiple exploit artifacts published on PacketStorm. Upgrading to one of the fixed releases listed in the advisory is the primary mitigation.

PacketStorm hosts working exploit code for the vulnerability, and the EPSS score has reached a peak of 0.9756 with a current value of 0.9440, indicating sustained exploitation interest after disclosure.