In Bitbucket Server, the deployment package for a web interface for working with git repositories, a critical vulnerability (CVE-2022-36804) has been discovered that allows a remote attacker with read access to private or public repositories to execute arbitrary code on the server by sending a specially crafted HTTP request. The issue affects versions starting from 6.10.17 and has been fixed in Bitbucket Server and Bitbucket Data Center releases 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.2.2, and 8.3.1. The vulnerability does not manifest in the cloud service bitbucket.org, but affects only the self-hosted products.
The vulnerability was identified by a security researcher as part of the Bugcrowd Bug Bounty initiative, which includes rewards for discovering previously unknown vulnerabilities. The reward amounted to 6 thousand dollars. Details about the attack method and a prototype of the exploit are promised to be revealed 30 days after the patch is published. As a precautionary measure to reduce the risk of attack on their systems until the patch is applied, it is recommended to restrict public access to repositories by setting `feature.public.access=false`.
Bron: opennet.ru
