Atlassian Bitbucket Archive API command injection attempt (CVE-2022-36804) in web requests

title: Atlassian Bitbucket Archive API command injection attempt (CVE-2022-36804) in web requests
id: 76e1110d-03bc-4b90-a80a-55834fd94d82
status: test
description: This rule flags web requests whose URI query contains Bitbucket project REST archive parameters along with the specific null-byte and execution marker pattern (%00--exec). Such requests match attempts to trigger command execution through the archive API, which can enable remote code execution on vulnerable Bitbucket instances. It relies on web server telemetry that records the requested URL query string (cs-uri-query).
references:
  - https://twitter.com/_0xf4n9x_/status/1572052954538192901
  - https://www.rapid7.com/blog/post/2022/09/20/cve-2022-36804-easily-exploitable-vulnerability-in-atlassian-bitbucket-server-and-data-center/
  - https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html
  - https://blog.assetnote.io/2022/09/14/rce-in-bitbucket-server/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-36804/web_cve_2022_36804_atlassian_bitbucket_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-29
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-36804
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains|all:
      - /rest/api/latest/projects/
      - prefix=
      - "%00--exec"
  condition: selection
falsepositives:
  - Web vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: 65c0a0ab-d675-4441-bd6b-d3db226a2685
    type: derived