ID:11173 - Exploit for OS Command Injection in Bitbucket Server and Bitbucket Data Center - CVE-2022-36804

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within multiple API endpoints. A remote attacker with access to a public repository or read permissions to a private Bitbucket repository can send a specially crafted HTTP request and execute arbitrary OS commands on the server.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation