imbas007/Atlassian-Bitbucket-CVE-2022-36804

GitHubRepository PoC

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2022-36804Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based environment that builds and runs Atlassian Bitbucket Server 7.17.1, a version known to be vulnerable to CVE-2022-36804. The environment is intended as a lab for testing and demonstrating the remote code execution vulnerability.

Dockerfile.txt:1-11README.md:1-54

Lab assessment

Vulnerability lab

The README explicitly states 'Lab for CVE-2022-36804' and provides instructions for building the Docker image, running the container, and using the provided exploit script against the vulnerable Bitbucket instance. The Dockerfile installs a specific vulnerable version (7.17.1) of Bitbucket Server.

README.md:5-6Dockerfile.txt:5
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Bitbucket Server

vulnerable target application

Atlassian Bitbucket Server version 7.17.1, installed from an official archive and started via its bundled script. It listens on port 7990 and contains the command injection vulnerability CVE-2022-36804.

Dockerfile.txt:5-11README.md:1-4

CVE-2022-36804.py

exploit script

A Python script that constructs and sends a malicious HTTP request to the Bitbucket Server archive endpoint, exploiting the command injection vulnerability to execute arbitrary commands on the target. It can check for RCE, run custom commands, and facilitate a reverse shell.

CVE-2022-36804.py:1-127README.md:14-44
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-36804

Supported by supplied evidence

The README, Dockerfile, and exploit script all reference CVE-2022-36804. The Dockerfile installs Bitbucket Server 7.17.1, which is within the affected version range listed in the README. The exploit script targets the specific API endpoint and injection pattern described in public advisories for this CVE.

README.md:1-4Dockerfile.txt:5CVE-2022-36804.py:1-4
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the container.README.md:6-11
  • Python 3 and the 'requests' library are required to run the exploit script.CVE-2022-36804.py:11
  • The target Bitbucket instance must be reachable over HTTP on port 7990.README.md:16

Evidence-described exercise path

  1. Build the Docker image using 'docker build -t bitbucket .'README.md:6-8
  2. Run the container with 'docker run -it bitbucket'README.md:10-11
  3. Execute the exploit script against the running container, e.g., 'python3 cve-2022-36804.py -u http://172.17.0.2:7990'README.md:15-16
  4. Optionally, set up a netcat listener and use the script to obtain a reverse shell.README.md:30-37
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the intentionally vulnerable Bitbucket instance inside the Docker container. The exploit script targets the lab's own service, and the reverse shell examples connect back to the attacker's machine, not to external systems. There is no evidence of host escape, persistence, credential theft, or any hidden malicious actions.

CVE-2022-36804.py:1-127README.md:14-44
Review boundaries

What the analysis did not establish

  • The Dockerfile uses 'USER root' and runs the application as root, which is a common but insecure practice in labs; however, it does not by itself indicate malicious intent.
  • The exploit script includes a reverse shell payload example that connects to an attacker-controlled IP; this is standard for demonstrating RCE impact and is not hidden or unnecessary for the exercise.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1