Bitbucket Server and Data Center Security Advisory 2022-11-16
Bitbucket Server and Data Center- Command Injection Vulnerability - CVE-2022-43781
Summary | CVE-2022-43781 - Command Injection Vulnerability |
|---|---|
Advisory Release Date | 16 Nov 2022 10 AM PDT (Pacific Time, -7 hours) |
Product |
|
CVE ID(s) | CVE-2022-43781 |
Summary of Vulnerability
This advisory discloses a critical severity security vulnerability introduced in version 7.0.0 of Bitbucket Server and Data Center. The following versions are affected by this vulnerability:
Bitbucket Data Center and Server 7.0 to 7.21
Bitbucket Data Center and Server 8.0 to 8.4 if mesh.enabled is set to false in bitbucket.properties
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to gain code execution and execute code on the system.
This issue can be tracked here: BSERV-13522 - Getting issue details... STATUS
Atlassian Cloud sites are not affected. If you access Bitbucket via a bitbucket.org domain, it is hosted by Atlassian and you are not affected by the vulnerability. |
Severity
Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.
This is our assessment and you should evaluate its applicability to your own IT environment.
Affected Versions
All versions of Bitbucket Server and Data Center from 7.0 to 7.21 are affected by this vulnerability. Versions 8.0 to 8.4 of Bitbucket Server and Data Center are also affected by this vulnerability if mesh.enabled=false is set in bitbucket.properties.
Product | Affected Versions |
|---|---|
Bitbucket Server and Data Center |
If mesh.enabled=false is set in bitbucket.properties:
|
Fixed Versions
Product | Fixed Versions |
|---|---|
Bitbucket Server and Data Center |
|
What You Need to Do
Atlassian recommends that you upgrade each of your affected installations to one of the listed fixed versions (or any later version) above (see the “Fixed Versions” section of this page for details). For a full description of the latest version of Bitbucket Server and Data Center, see the release notes. You can download the latest version of Bitbucket from the download center. For Frequently Asked Questions (FAQ) click here.
Mitigation
To remediate this vulnerability, update each affected product installation to a fixed version listed above.
If you’re unable to upgrade your Bitbucket instance, a temporary mitigation step is to disable “Public Signup”. Disabling public signup would change the attack vector from an unauthenticated attack to an authenticated one which would reduce the risk of exploitation. To disable this setting, go to Administration > Authentication and clear the Allow public sign up checkbox.
ADMIN or SYS_ADMIN authenticated users still have the ability to exploit the vulnerability when public signup is disabled. For this reason, this mitigation should be treated as a temporary step and customers are recommended to upgrade to a fixed version as soon as possible.
Bitbucket Server and Data Center instances running PostgreSQL are not affected by the vulnerability.
Acknowledgements
Information that led to the discovery of this vulnerability was provided by @Ry0taK.
Support
If you did not receive an email for this advisory and you wish to receive such emails in the future go to https://my.atlassian.com/email and subscribe to Alerts emails.
If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/.
References
As per our new policy critical security bug fixes will be back ported in accordance with https://www.atlassian.com/trust/security/bug-fix-policy. We will release new maintenance releases for the versions covered by the policy instead of binary patches. Binary patches are no longer released. | |
Atlassian security advisories include a severity level and a CVE identifier. This severity level is based on our self-calculated CVSS score for each specific vulnerability. CVSS is an industry standard vulnerability metric. You can also learn more about CVSS at FIRST.org. | |
Our end of life policy varies for different products. Please refer to our EOL Policy for details. |