Atlassian Bitbucket Command Injection Attempt via Archive API Parameters (Webserver)
Alerts on Bitbucket REST archive query parameters containing a %00--exec execution marker.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-29
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags HTTP requests to a Bitbucket REST API endpoint that include parameters indicative of a command injection attempt targeting the archive functionality. Attackers may use crafted query strings to trigger unintended command execution on the Bitbucket server. The detection relies on webserver telemetry capturing the requested URI query string and matching specific substrings associated with the exploit attempt.
Reporting behind it
- twitter.comhttps://twitter.com/_0xf4n9x_/status/1572052954538192901
- rapid7.comhttps://www.rapid7.com/blog/post/2022/09/20/cve-2022-36804-easily-exploitable-vulnerability-in-atlassian-bitbucket-server-and-data-center/
- confluence.atlassian.comhttps://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html
- blog.assetnote.iohttps://blog.assetnote.io/2022/09/14/rce-in-bitbucket-server/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-36804/web_cve_2022_36804_atlassian_bitbucket_command_injection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Atlassian Bitbucket Command Injection Attempt via Archive API Parameters (Webserver)
id: 76e1110d-03bc-4b90-a80a-55834fd94d82
status: test
description: This rule flags HTTP requests to a Bitbucket REST API endpoint that include parameters indicative of a command injection attempt targeting the archive functionality. Attackers may use crafted query strings to trigger unintended command execution on the Bitbucket server. The detection relies on webserver telemetry capturing the requested URI query string and matching specific substrings associated with the exploit attempt.
references:
- https://twitter.com/_0xf4n9x_/status/1572052954538192901
- https://www.rapid7.com/blog/post/2022/09/20/cve-2022-36804-easily-exploitable-vulnerability-in-atlassian-bitbucket-server-and-data-center/
- https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24-1155489835.html
- https://blog.assetnote.io/2022/09/14/rce-in-bitbucket-server/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-36804/web_cve_2022_36804_atlassian_bitbucket_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-29
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2022-36804
- detection.emerging-threats
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains|all:
- /rest/api/latest/projects/
- prefix=
- "%00--exec"
condition: selection
falsepositives:
- Web vulnerability scanners
level: high
license: DRL-1.1
related:
- id: 65c0a0ab-d675-4441-bd6b-d3db226a2685
type: derived