On August 24, 2022, Atlassian published [an advisory for Bitbucket Server and Data Center]() alerting users to [CVE-2022-36804](). The advisory reveals a command injection vulnerability in multiple API endpoints, which allows an attacker with access to a public repository or with **read permissions** to a private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. CVE-2022-36804 carries a CVSSv3 score of 9.8 and is easily exploitable. Rapid7’s vulnerability research team has a [full technical analysis in AttackerKB](), including how to use CVE-2022-36804 to create a simple reverse shell.

[According to Shodan](), there are about 1,400 internet-facing servers, but it’s not immediately obvious how many have a public repository. There are no public reports of exploitation in the wild as of September 20, 2022, but there has been strong interest in the vulnerability from researchers and exploit brokers, and there are now multiple public exploits available. Because the vulnerability is trivially exploitable and the patch is relatively simple to reverse- engineer, it’s likely that targeted exploitation has already occurred in the wild. We expect to see larger-scale exploitation of CVE-2022-36804 soon.

**Affected products:**
Bitbucket Server and Data Center 7.6 prior to 7.6.17
Bitbucket Server and Data Center 7.17 prior to 7.17.10
Bitbucket Server and Data Center 7.21 prior to 7.21.4
Bitbucket Server and Data Center 8.0 prior to 8.0.3
Bitbucket Server and Data Center 8.1 prior to 8.1.3
Bitbucket Server and Data Center 8.2 prior to 8.2.2
Bitbucket Server and Data Center 8.3 prior to 8.3.1

## Mitigation guidance

Organizations that use Bitbucket Server and Data Center in their environments should patch as quickly as possible [using Atlassian’s guide](), without waiting for a regular patch cycle to occur. Blocking network access to Bitbucket may also function as a temporary stop-gap solution, but this should not be a substitute for patching.

## Rapid7 customers

Our engineering team is in the process of developing a vulnerability check for CVE-2022-36804. We will update this blog with further information as it becomes available.

#### NEVER MISS A BLOG

Get the latest stories, expertise, and news about security today.

Subscribe

_**Additional reading:**_

* _[Active Exploitation of Multiple Vulnerabilities in Zimbra Collaboration Suite]()_
* _[Active Exploitation of Atlassian’s Questions for Confluence App CVE-2022-26138]()_
* _[Exploitation of Mitel MiVoice Connect SA CVE-2022-29499]()_
* _[CVE-2022-27511: Citrix ADM Remote Device Takeover]()_Read More