Atlassian Releases Patches for Critical Flaws Affecting Crowd and Bitbucket Products

Australian software company Atlassian has rolled out security
updates to address two critical flaws^[1]
affecting Bitbucket Server, Data Center, and Crowd products.

The issues, tracked as CVE-2022-43781^[2] and CVE-2022-43782^[3], are both rated 9 out of
10 on the CVSS vulnerability scoring system.

CVE-2022-43781, which Atlassian said was introduced in version
7.0.0 of Bitbucket Server and Data Center, affects versions 7.0 to
7.21 and 8.0 to 8.4 (only if mesh.enabled is set to false in
bitbucket.properties).

The weakness has been described as a case of command injection
using environment variables in the software, which could allow an
adversary with permission to control their username to gain code
execution on the affected system.

As a temporary workaround, the company is recommending users
turn off the “Public Signup” option (Administration >
Authentication).

“Disabling public signup would change the attack vector from an
unauthenticated attack to an authenticated one which would reduce
the risk of exploitation,” it noted in an advisory. “ADMIN or
SYS_ADMIN authenticated users still have the ability to exploit the
vulnerability when public signup is disabled.”

The second vulnerability, CVE-2022-43782, concerns a
misconfiguration in Crowd Server and Data Center that could permit
an attacker to invoke privileged API endpoints, but only in
scenarios where the bad actor is connecting from an IP address
added to the Remote Address configuration.

Introduced in Crowd 3.0.0 and identified during an internal
security review, the shortcoming impacts all new installations,
meaning users who upgraded from a version prior to Crowd 3.0.0 are
not vulnerable.

It’s not uncommon for flaws in Atlassian and Bitbucket to be
subjected^[4]
to active exploitation^[5]
in the wild, making it imperative that users move quickly to apply
the patches.

Last month, the U.S. Cybersecurity and Infrastructure Security
Agency (CISA) warned^[6]
that a command injection flaw in Bitbucket Server and Data Center
(CVE-2022-36804, CVSS score: 9.9) was being weaponized in attacks
since late September 2022.