Bitbucket Server and Data Center Remote Code Execution Vulnerability Alert

by ·

Recently, Bitbucket officially released a security notice, which contained three remote code execution vulnerabilities, and the vulnerability level is critical.

Bitbucket is a web-based version control repository hosting service owned by Atlassian, for source code and development projects that use either Mercurial or Git revision control systems. Bitbucket offers both commercial plans and free accounts.

Bitbucket Server vulnerability

The security advisory disclosed three remote code execution vulnerabilities:

  • CVE-2019-15010
  • CVE-2019-20097
  • CVE-2019-15012

An attacker can use the above vulnerabilities to attack by constructing a specific attack payload. When the attack is successfully used, he can execute arbitrary commands on the victim’s Bitbucket Server and Data Center.

We judge that the vulnerability level is high and the harm/impact is wide. Users of Bitbucket Server and Data Center are advised to install the latest patches in time to avoid hacking.

CVE-2019-15010

Bitbucket Server and Data Center versions starting from 3.0.0 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim’s systems. Using a specially crafted payload as user input, the attacker can execute arbitrary commands on the victim’s Bitbucket server or Data Center instance.

CVE-2019-20097

Bitbucket Server and Data Center versions starting from 1.0.0 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim’s Bitbucket Server or Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Data Center systems, using a file with specially crafted content.

CVE-2019-15012

Bitbucket Server and Data Center versions >= 4.13 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victim’s Bitbucket Server or Data Center instance using the edit-file endpoint, if the user Bitbucket Server or Data Center is running as has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victim’s Bitbucket Server instance.

User, please upgrade Bitbucket Server or Data Center to the latest version.

Tags: