A Bitbucket Server, a package for deploying a web interface for working with git repositories, a critical vulnerability (CVE-2022-36804) has been identified, allowing a remote attacker with read access to private or public repositories to execute arbitrary code on the server by sending a specially crafted HTTP request. The issue manifests starting from version 6.10.17 and has been resolved in the releases of Bitbucket Server and Bitbucket Data Center 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.2.2, and 8.3.1. The vulnerability does not appear in the cloud service bitbucket.org and only affects on-premises products.
The vulnerability was discovered by a security researcher as part of the Bugcrowd Bug Bounty initiative, which provides rewards for identifying previously unknown vulnerabilities. The reward amount was $6,000. Details about the attack method and the exploit prototype are promised to be disclosed 30 days after the release of the fix. As a risk mitigation measure for attacks on their systems until the fix is applied, it is recommended to restrict public access to repositories by setting "feature.public.access=false".
Forrás: opennet.ru
