Bitbucket Server Archive Command Injection

Product: Atlassian Bitbucket Server / Data Center
CVE: CVE-2022-36804
Disclosed: 2022-08-24
CVSS: 8.8
Auth: requires auth / interaction
CISA KEV: yes
Affected: 7.0.0 - 7.6.16, 7.7.0 - 7.17.9, 7.18.0 - 7.21.3, 8.0.0 - 8.0.2, 8.1.0 - 8.1.2, 8.2.0 - 8.2.1, 8.3.0
Fixed: 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, 8.3.1

Summary

Bitbucket's repository archive REST endpoint passed user-controlled parameters to 'git archive', and NUL bytes let attackers smuggle extra arguments. It needs only repository read access, which means no authentication at all for public repos.

Root cause

The 'prefix' (and other) parameters were passed through to a native process-spawning library that terminated arguments at NUL bytes, so '%00' splits one argument into several. Injecting '--remote' and '--exec=<cmd>' makes git archive run an arbitrary command.

Impact

RCE as the Bitbucket user for anyone with read access to a repo (pre-auth if public repos exist).

Public PoC

GET /rest/api/latest/projects/{PROJECT}/repos/{REPO}/archive?format=zip&path=bighax&prefix=test/%00--remote=/%00--exec={URL_ENCODED_CMD}%00--prefix=/

Source: notdls / CVE-2022-36804

Detection

Look for /rest/api/latest/projects/*/repos/*/archive requests containing '%00' or '--exec'. nuclei template CVE-2022-36804.

Mitigation

Upgrade to a fixed version; as a stopgap disable public access (feature.public.access=false).