github - ghsa-3883-h64p-r3xm

GHSA-3883-H64P-R3XM

Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2024-10-02 18:31

Details

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-43781"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-17T00:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled \u201cAllow public signup\u201d.",
  "id": "GHSA-3883-h64p-r3xm",
  "modified": "2024-10-02T18:31:31Z",
  "published": "2023-07-06T19:24:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43781"
    },
    {
      "type": "WEB",
      "url": "https://confluence.atlassian.com/x/Y4hXRg"
    },
    {
      "type": "WEB",
      "url": "https://jira.atlassian.com/browse/BSERV-13522"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-43781 (GCVE-0-2022-43781)

Vulnerability from cvelistv5 – Published: 2022-11-17 00:00 – Updated: 2024-10-02 14:56

Summary

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

RCE (Remote Code Execution)

Assigner

atlassian

References

URL

Tags

	https://confluence.atlassian.com/x/Y4hXRg
	https://jira.atlassian.com/browse/BSERV-13522

Impacted products

Vendor

Product

Version

Atlassian

Bitbucket Data Center

Unaffected: before 7.0
Affected: before 7.17.12
Affected: before 7.21.6
Affected: before 7.6.19
Affected: before 8.0.5
Affected: before 8.1.5
Affected: before 8.2.4
Affected: before 8.3.3
Affected: before 8.4.2
Affected: before 8.5.0

Atlassian

Bitbucket Server

Credits

https://github.com/Ry0taK

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T13:40:06.623Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://confluence.atlassian.com/x/Y4hXRg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jira.atlassian.com/browse/BSERV-13522"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "bitbucket",
            "vendor": "atlassian",
            "versions": [
              {
                "lessThan": "7.6.19",
                "status": "affected",
                "version": "7.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "7.17.12",
                "status": "affected",
                "version": "7.7.0",
                "versionType": "custom"
              },
              {
                "lessThan": "7.21.6",
                "status": "affected",
                "version": "7.18.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.0.5",
                "status": "affected",
                "version": "7.22.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.1.5",
                "status": "affected",
                "version": "8.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.2.4",
                "status": "affected",
                "version": "8.2.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.3.3",
                "status": "affected",
                "version": "8.3.0",
                "versionType": "custom"
              },
              {
                "lessThan": "8.4.2",
                "status": "affected",
                "version": "8.4.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-43781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-02T14:27:57.305026Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-02T14:56:09.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Bitbucket Data Center",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "before 7.0"
            },
            {
              "status": "affected",
              "version": "before 7.17.12"
            },
            {
              "status": "affected",
              "version": "before 7.21.6"
            },
            {
              "status": "affected",
              "version": "before 7.6.19"
            },
            {
              "status": "affected",
              "version": "before 8.0.5"
            },
            {
              "status": "affected",
              "version": "before 8.1.5"
            },
            {
              "status": "affected",
              "version": "before 8.2.4"
            },
            {
              "status": "affected",
              "version": "before 8.3.3"
            },
            {
              "status": "affected",
              "version": "before 8.4.2"
            },
            {
              "status": "affected",
              "version": "before 8.5.0"
            }
          ]
        },
        {
          "product": "Bitbucket Server",
          "vendor": "Atlassian",
          "versions": [
            {
              "status": "unaffected",
              "version": "before 7.0"
            },
            {
              "status": "affected",
              "version": "before 7.17.12"
            },
            {
              "status": "affected",
              "version": "before 7.21.6"
            },
            {
              "status": "affected",
              "version": "before 7.6.19"
            },
            {
              "status": "affected",
              "version": "before 8.0.5"
            },
            {
              "status": "affected",
              "version": "before 8.1.5"
            },
            {
              "status": "affected",
              "version": "before 8.2.4"
            },
            {
              "status": "affected",
              "version": "before 8.3.3"
            },
            {
              "status": "affected",
              "version": "before 8.4.2"
            },
            {
              "status": "affected",
              "version": "before 8.5.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "https://github.com/Ry0taK"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled \u201cAllow public signup\u201d."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "RCE (Remote Code Execution)",
              "lang": "en",
              "type": "RCE (Remote Code Execution)"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-17T00:00:01.210Z",
        "orgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
        "shortName": "atlassian"
      },
      "references": [
        {
          "url": "https://confluence.atlassian.com/x/Y4hXRg"
        },
        {
          "url": "https://jira.atlassian.com/browse/BSERV-13522"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f08a6ab8-ed46-4c22-8884-d911ccfe3c66",
    "assignerShortName": "atlassian",
    "cveId": "CVE-2022-43781",
    "datePublished": "2022-11-17T00:00:01.210Z",
    "dateReserved": "2022-10-26T14:49:11.114Z",
    "dateUpdated": "2024-10-02T14:56:09.693Z",
    "requesterUserId": "4ceb4895-2afc-4c29-bf72-c2e04b367c52",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-3883-H64P-R3XM

CVE-2022-43781 (GCVE-0-2022-43781)

Tags

Sightings

Nomenclature