Australian software company Atlassian has released fixes to address a critical vulnerability in Bitbucket Server and Data Center.
The vulnerability, identified as CVE-2022-36804, has a severity of 9.9 and could grant attacker access to execute malicious code on vulnerable installations.
Further investigation shows that the problem is a command injection vulnerability in multiple endpoints that could be exploited via specially crafted HTTP requests.
The bug affects all versions of Bitbucket Server, and Datacenter released after 6.10.17, including Bitbucket Server and Datacenter 7.0.0, Bitbucket Server and Datacenter 7.6, Bitbucket Server and Datacenter 7.17, Bitbucket Server and Datacenter 7.21, Bitbucket Server and Datacenter 8.0, Bitbucket Server and Datacenter 8.1, Bitbucket Server and Datacenter 8.2, and Bitbucket Server and Datacenter 8.3.
Users of affected versions are advised to upgrade their instances to the latest version as soon as possible to mitigate potential threats.
For those who are unable to apply the patches immediately, Atlassian has also provided a temporary workaround. This involves turning off public repositories using “features.public.access=false” to prevent unauthorized users from exploiting the vulnerability.
The sources for this piece include an article in TheHackerNews.