CVE-2022-43781

EIP tracks 1 public exploit for CVE-2022-43781. PoCs published by Ry0taK, y4er, Shelby Pace, including Metasploit module exploits/multi/http/bitbucket_env_var_rce.

AI-analyzed exploit summary This Metasploit module exploits CVE-2022-43781, an authenticated command injection vulnerability in Bitbucket. It achieves RCE by injecting the `GIT_EXTERNAL_DIFF` environment variable into a user's username, which is executed when Bitbucket generates a diff.

There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.