Atlassian Bitbucket Server and Data Center Remote Code Execution (RCE) Vulnerability Advisory (CVE-2022-36804)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-36804) is a critical command and argument injection flaw residing in multiple API endpoints of Atlassian Bitbucket Server and Data Center. The root cause lies in the improper validation and sanitization of user-supplied input before passing it to internal Git command executions (CWE-78, CWE-88). By injecting malicious arguments that are interpreted as command-line options by the underlying Git process, an attacker can bypass intended execution boundaries.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must have read access to at least one Bitbucket repository (either a public repository or a private one to which they have authorized access). The attacker crafts a malicious HTTP request targeting specific REST API endpoints that trigger Git operations under the hood. By embedding command-line flags such as --exec or --upload-pack into the request parameters, the attacker forces the server to execute arbitrary system commands. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

With a CVSS score of 8.8 (High), the impact of successful exploitation is severe. An attacker can gain arbitrary shell execution privileges under the context of the Bitbucket service account. This can lead to complete compromise of the host system, unauthorized exfiltration of proprietary source code, supply chain tampering, and lateral movement into the broader corporate network.