## https://sploitus.com/exploit?id=8C1053FE-3B10-514F-ACC1-7EF452329191
# CVE-2022-36804 Bitbucket PoC
This repository contains a Python exploit script for Atlassian Bitbucket Server/Data Center vulnerability CVE-2022-36804. The issue is a command-injection flaw in the Git archive flow, where crafted `prefix` parameters can be interpreted by the server and executed as shell commands.
## What is CVE-2022-36804?
CVE-2022-36804 is a Bitbucket Server/Data Center remote command execution vulnerability. It was caused by unsafe handling of the `prefix` value on the archive endpoint, allowing attacker-controlled data to reach a shell invocation through Git. The consequence is unauthenticated or authenticated command execution depending on the path and deployment model.
This script targets the vulnerable archive endpoint and uses a crafted request to trigger the injection.
## Bitbucket versions
This PoC is intended for affected Bitbucket Server/Data Center builds covered by Atlassian advisory for CVE-2022-36804. In practice, the vulnerable range includes older 7.x/8.x Bitbucket Server/Data Center releases before the fixed versions listed by Atlassian. It is not meant for patched or upgraded builds.
Use this only against systems you own or are explicitly authorized to test.
## How the script works
The script sends a request to:
```text
/rest/api/latest/projects/{project}/repos/{repo}/archive
```
with a specially crafted `prefix` parameter that looks like:
```text
ax%00--exec=``%00--remote=origin
```
The trick is to exploit the null-byte / Git command path so the server ends up executing a shell command from the archive request. The script wraps the command in gzip + base64 when needed so the output is returned compactly and decoded locally.
The script supports two main modes:
- command execution: runs a shell command and prints output
- file reconstruction: builds a file remotely by writing base64-encoded chunks to a destination path
## Supported features / commands
### Command execution
```bash
python cve-2022-36804_v5.py -p -r -c "whoami"
```
Options:
- `-c, --command`: run a command
- `--no-encode`: send the raw command without gzip+base64 wrapping
- `-p, --project`: Bitbucket project key
- `-r, --repo`: Bitbucket repo slug
### Remote file copy / reconstruction
```bash
python cve-2022-36804_v5.py -p -r -f /path/to/local.bin -o /tmp/remote.bin
```
This reads a local file in chunks, base64-encodes each chunk, and uses the exploit to reconstruct it on the server at the target path.
### Internal helpers supported by the script
- gzip + base64 command wrapping for output transport
- base64 output decoding (including gzip-compressed output)
- file chunking and transfer with temporary file cleanup
- robust handling of truncated output strings
- optional raw execution mode for fire-and-forget commands
## Notes
- The script uses `requests.Session` with basic auth.
- It disables certificate verification (`verify = False`) to simplify testing against self-signed endpoints.
- It is a PoC and is intentionally focused on exploitation behavior rather than stealth or production hardening.
## Warning
This tool is for authorized security research and controlled testing only. Using it against systems you do not own or do not have permission to test is illegal and unethical.