CVE-2022-36804: Atlassian Bitbucket Server and Data Center Command Injection Vulnerability

CVE-2022-36804 is a command injection vulnerability affecting Atlassian Bitbucket Server and Data Center. Multiple API endpoints allow an attacker who can reach a public repository, or who holds read permissions on a private one, to execute code by sending a crafted HTTP request. For teams running self-hosted Bitbucket instances that host source code and build pipelines, this can lead to full system compromise, data theft, or further lateral movement inside the environment.

Because the only prerequisite is repository access rather than administrative privileges, the attack surface can be larger than many operators expect. Confirm all version, configuration, and remediation details against the official Atlassian advisory before acting.

How it works

The flaw belongs to the command-injection family (CWE-78, CWE-88, CWE-158). In essence, user-controlled input that reaches an API endpoint is not properly sanitized before it is passed to an operating-system command or argument list. An attacker who already has read access to a repository crafts an HTTP request that injects additional shell metacharacters or arguments. When the vulnerable endpoint processes that request, the injected content is executed with the privileges of the Bitbucket process.

No public exploit code or precise payload format is provided here; defenders should treat any unexpected request to Bitbucket API paths as potentially malicious and validate behavior against the vendor’s technical description.

Am I affected? How to find it in your systems

Bitbucket Server and Data Center are typically deployed on-premises or in private cloud environments as the central Git repository and CI/CD hub. Inventory steps include:

• Query configuration-management databases, asset inventories, or container registries for hosts or images labeled “Bitbucket Server” or “Bitbucket Data Center.”
• Scan internal networks for the default Bitbucket ports and HTTP banners that identify the product.
• Review application-server logs and reverse-proxy access logs for traffic to Bitbucket API endpoints, especially those that accept repository-related parameters.
• Check whether any repositories are configured as public or whether large numbers of users hold read permissions; both conditions expand the set of potential attackers.

Exact affected version ranges are not listed in the supplied facts; compare your installed build numbers against the vendor advisory. Telemetry signs of exploitation may include unusual process spawning by the Bitbucket service account, unexpected outbound network connections from the Bitbucket host, or HTTP requests containing shell metacharacters in query strings or POST bodies.

How to remediate

The primary action is to apply the updates published by Atlassian, following the vendor’s installation and restart instructions. CISA’s required action is simply “Apply updates per vendor instructions.” After patching:

• Restart the Bitbucket service and verify the new version string.
• Re-validate that public repositories and overly broad read permissions are still required; tighten them where possible.
• Review and rotate any credentials or SSH keys that may have been accessible to the Bitbucket process.
• Enable or strengthen application-level logging so that future API abuse is easier to detect.

These steps reduce both the immediate vulnerability and the residual risk from similar injection flaws.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Place Bitbucket behind a network segment that restricts inbound access to only trusted management and developer subnets.
• If a web application firewall is available, create temporary rules that block or alert on requests containing common command-injection metacharacters aimed at Bitbucket API paths (virtual patching).
• Temporarily disable public repository access or convert public repositories to private while the patch window is open.
• Increase monitoring of process creation, file-system changes, and outbound connections originating from the Bitbucket host; feed these events into the SIEM with high-priority alerts.
• Limit the operating-system privileges of the Bitbucket service account so that successful injection yields less impact.

These measures do not eliminate the vulnerability but shrink the window of opportunity for an attacker.

If your data may have been exposed

Command-injection flaws that allow remote code execution can be used to exfiltrate source code, credentials, or other sensitive data stored on or accessible from the Bitbucket host. Even when ransomware use is not documented for this CVE, any successful exploitation constitutes a potential breach. Review access logs for anomalous API activity, examine the host for unexpected processes or files, and rotate secrets that may have been compromised. As an additional check, individuals can run a free exposure scan of their work email addresses against known breach data sets to determine whether related credentials have already appeared in public dumps.