Description
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21.4, from version 8.0.0 before version 8.0.3, from version 8.1.0 before version 8.1.3, and from version 8.2.0 before version 8.2.2, and from version 8.3.0 before 8.3.1 allows remote attackers with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request. This vulnerability was reported via our Bug Bounty Program by TheGrandPew.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Atlassian | Bitbucket Server | 7.0.0 – < unspecified, unspecified – < 7.6.17, 7.7.0 – < unspecified, unspecified – < 7.17.10, 7.18.0 – < unspecified, unspecified – < 7.21.4, 8.0.0 – < unspecified, unspecified – < 8.0.3, 8.1.0 – < unspecified, unspecified – < 8.1.3, 8.2.0 – < unspecified, unspecified – < 8.2.2, 8.3.0 – < unspecif… | unspecified |
| Atlassian | Bitbucket Data Center | 7.0.0 – < unspecified, unspecified – < 7.6.17, 7.7.0 – < unspecified, unspecified – < 7.17.10, 7.18.0 – < unspecified, unspecified – < 7.21.4, 8.0.0 – < unspecified, unspecified – < 8.0.3, 8.1.0 – < unspecified, unspecified – < 8.1.3, 8.2.0 – < unspecified, unspecified – < 8.2.2, 8.3.0 – < unspecif… | unspecified |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Bitbucket Git Command Injection
exploit/linux/http/bitbucket_git_cmd_injection
Exploit-DB 1
- Bitbucket v7.0.0 - RCE EDB-51040 · webapps · Mar 23, 2023
GitHub 19 repositories · most starred shown
-
notdls/CVE-2022-36804 ★ 35 · Sep 7, 2022
A real exploit for BitBucket RCE CVE-2022-36804
-
notxesh/CVE-2022-36804-PoC ★ 18 · Sep 19, 2022
Multithreaded exploit script for CVE-2022-36804 affecting BitBucket versions <8.3.1
-
benjaminhays/CVE-2022-36804-PoC-Exploit ★ 16 · Sep 20, 2022
Somewhat Reliable PoC Exploit for CVE-2022-36804 (BitBucket Critical Command Injection)
-
sh4den/CVE-2022-36804 ★ 12 · Sep 26, 2022
A loader for bitbucket 2022 rce (cve-2022-36804)
-
walnutsecurity/cve-2022-36804 ★ 8 · Jan 23, 2023
A critical command injection vulnerability was found in multiple API endpoints of the Atlassian Bit bucket Server and Data center. This vulnerability affects all versions of Bitbucket Server and Data…
-
ColdFusionX/CVE-2022-36804 ★ 7 · Oct 4, 2022
Atlassian Bitbucket Server and Data Center - Command Injection Vulnerability (CVE-2022-36804)
-
tahtaciburak/cve-2022-36804 ★ 7 · Sep 25, 2022
A simple PoC for Atlassian Bitbucket RCE [CVE-2022-36804]
-
kljunowsky/CVE-2022-36804-POC ★ 7 · Sep 21, 2022
Bitbucket CVE-2022-36804 unauthenticated remote command execution
-
Chocapikk/CVE-2022-36804-ReverseShell ★ 4 · Sep 23, 2022
PoC exploit for CVE-2022-36804 (BitBucket Critical Command Injection)
-
Vulnmachines/bitbucket-cve-2022-36804 ★ 3 · Sep 20, 2022
CVE-2022-36804 Atlassian Bitbucket Command Injection Vulnerability
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Atlassian Bitbucket - Remote Command Injection http/cves/2022/CVE-2022-36804.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.