CISA Warns of Hackers Exploiting Critical Atlassian Bitbucket Server Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
on Friday added^[1]
a recently disclosed critical flaw impacting Atlassian’s Bitbucket
Server and Data Center to the Known Exploited Vulnerabilities
(KEV^[2]) catalog, citing
evidence of active exploitation.

Tracked as CVE-2022-36804^[3], the issue relates to a
command injection vulnerability that could allow malicious actors
to gain arbitrary code execution on susceptible installations by
sending a specially crafted HTTP request.

Successful exploitation, however, banks on the prerequisite that
the attacker already has access to a public repository or possesses
read permissions to a private Bitbucket repository.

“All versions of Bitbucket Server and Datacenter released after
6.10.17 including 7.0.0 and newer are affected, this means that all
instances that are running any versions between 7.0.0 and 8.3.0
inclusive are affected by this vulnerability,” Atlassian noted^[4]
in a late August 2022 advisory.

CISA did not provide further details about how the flaw is being
exploited and how widespread exploitation efforts are, but
GreyNoise said^[5]
it detected evidence of in-the-wild on September 20 and 23.

As countermeasures, all Federal Civilian Executive Branch (FCEB)
agencies are required to remediate the vulnerabilities by October
21, 2022 to protect networks against active threats.