CVE-2022-36804

Multiple API endpoints in Atlassian Bitbucket Server and Data Center contain an OS command injection flaw (CWE-78, with argument injection CWE-88) that allows a remote attacker to run arbitrary commands on the server. It is triggered by sending a malicious HTTP request to an affected API endpoint and requires only read permission to any public or private Bitbucket repository, meaning most authenticated users — and users of public repositories — can trigger it. Successful exploitation yields arbitrary code execution on the Bitbucket host, exposing source code and potentially the wider system. All Bitbucket Server and Data Center releases from 7.0.0 through the listed pre-fix versions are affected, with fixes in 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.3, 8.2.2, and 8.3.1. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities Catalog on 2022-09-30, public PoC exploits exist, and EPSS assigns a ~99.2% probability of exploitation within 30 days.

What to do: Immediately upgrade Bitbucket Server/Data Center per vendor instructions to 7.6.17+, 7.17.10+, 7.21.4+, 8.0.3+, 8.1.3+, 8.2.2+, or 8.3.1+ depending on your release branch — this is a CISA KEV-listed, actively exploited vulnerability. Until patched, restrict internet-facing access to Bitbucket instances and review HTTP access and audit logs for suspicious requests to REST API endpoints, which would indicate attempted or successful exploitation.