# Breaking Bitbucket: Pre Auth Remote Command Execution (CVE-2022-36804)

Null-byte argument injection into Bitbucket's archive API prefix param let unauthenticated attackers inject git --exec/--remote flags to run arbitrary commands.

- Payout: $6,000
- Severity: critical
- Program: Bitbucket Server
- Credited: Assetnote
- Disclosed: 2024-02-17
- CVE: CVE-2022-36804
- Write-up quality: 9/10
- Original: https://www.assetnote.io/resources/research/breaking-bitbucket-pre-auth-remote-command-execution-cve-2022-36804
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-breaking-bitbucket-pre-auth-remote-command-execution-cve-2022-36804
- Tags: domain:web impact:rce kind:research platform:research sev:critical tech:java technique:recon technique:reverse-engineering technique:source-review vuln:command-injection vuln:rce

**Target:** Bitbucket Server REST archive endpoint (/rest/api/latest/projects/{projectKey}/repos/{repoSlug}/archive)
**Root cause:** The prefix parameter is passed into the git archive subcommand; com.zaxxer.nuprocess prepareProcess builds a NUL-separated char array for forkAndExec, so embedded %00 in user input splits into new argv entries, enabling argument injection.
**Steps:**
1. Set up Bitbucket Server in Docker; run pspy to log spawned processes.
2. Create a repo and replace request values with canary 'PEWPEW' to find git sinks.
3. Identify /rest/api/latest/projects/{projectKey}/repos/{repoSlug}/archive with prefix param mapping to --prefix=.
4. Confirm injection with `prefix=padding%00--option%00padding`; error shows '--option is not a option to git subcmd'.
5. Locally test `git archive --prefix xd --exec='echo pew#' --remote=file:///tmp/ -- blah` which execve's `/bin/sh -c 'echo pew# /tmp'`.
6. Send `GET /rest/api/latest/projects/{projectKey}/repos/{repoSlug}/archive?prefix=x%00--exec=/bin/bash+-c+'touch+/tmp/haced%23'%00--remote=file:///%00x` unauthenticated.
**How found:** Inspired by William Bowling's GitHub Enterprise RCE writeup; hypothesized similar git command sinks in Bitbucket. Used pspy to log process spawns while exercising repo actions, injected canary strings into requests to trace user input into git commands, found a benign argument injection in browse?at=--help, then revisited and found the archive endpoint's prefix param.
**Exploitation:** Unauthenticated attacker needs a public repo and known projectKey/repoSlug. Injecting %00-delimited args into prefix adds --exec and --remote to git archive; git runs the --exec value via /bin/sh -c, achieving arbitrary command execution as the Bitbucket service user.
**Insight:** When a Java app shells out via nuprocess/JNI forkAndExec, NUL bytes in user input split argv entries — test %00-delimited argument injection on any param that maps to a CLI flag, and look for git subcommands with --exec/--upload-pack style flags that run commands.