Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-11706

Bitbucket Data Center - Path traversal in the migration tool leads to RCE - CVE-2019-3397

XMLWordPrintable

      Issue Summary

      Bitbucket Data Center had a path traversal vulnerability in the Data Center migration tool. A remote attacker with authenticated user with admin permissions can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Bitbucket Data Center. Bitbucket Server versions without a Data Center license are not vulnerable to this vulnerability.

      Affected versions of Bitbucket Data Center:

      • 5.13.0 <= version < 5.13.6
      • 5.14.0 <= version < 5.14.4
      • 5.15.0 <= version < 5.15.3
      • 5.16.0 <= version < 5.16.3
      • 6.0.0 <= version < 6.0.3
      • 6.1.0 <= version 6.1.2

      What You Need to Do

      Atlassian recommends that you upgrade to the latest version. For a full description of the latest version of Bitbucket Data Center, see the release notes. You can download the latest version of Bitbucket Data Center from the download centre.

       

      Upgrade Bitbucket Data Center to version 6.1.2 or higher.

      If you are running Bitbucket Data Center 5.13.x and cannot upgrade to 6.1.2  then upgrade to version 5.13.6.

      If you are running Bitbucket Data Center 5.14.x and cannot upgrade to 6.1.2 then upgrade to version 5.14.4.

      If you are running Bitbucket Data Center 5.15.x and cannot upgrade to 6.1.2 then upgrade to version 5.15.3.

      If you are running Bitbucket Data Center 5.16.x and cannot upgrade to 6.1.2 then upgrade to version 5.16.3.

      If you are running Bitbucket Data Center 6.0.x and cannot upgrade to 6.1.2 then upgrade to version 6.0.3.

      Mitigation

      The import functionality can be disabled via a feature flag, which would mitigate this vulnerability. This can be done by setting the property feature.data.center.migration.import=false in bitbucket.properties. Note that the export functionality would still work in this case. Bitbucket Server must then be restarted for changes to become effective.

      If an import task still needs to be run, enable the feature on an isolated cluster node (inaccessible by users and admins but still connected to the cluster and accessible by sysadmins) with a node-local bitbucket.properties file where the property feature.data.center.migration.import=true is set. Imports can then be started by talking to this node directly while it would still be disabled on other nodes.

       

      For additional details, see the full advisory: 

      https://confluence.atlassian.com/bitbucketserver/bitbucket-data-center-path-traversal-in-the-migration-tool-rce-cve-2019-3397-969526871.html

          Form Name

            [BSERV-11706] Bitbucket Data Center - Path traversal in the migration tool leads to RCE - CVE-2019-3397

            Sparsh added a comment -

            This is an independent assessment and you should evaluate its applicability to your own IT environment.

            CVSS v3 score: 9.1 => Critical severity

            Exploitability Metrics

            Attack Vector Network
            Attack Complexity Low
            Privileges Required High
            User Interaction None

            Scope Metric

            Scope Changed

            Impact Metrics

            Confidentiality High
            Integrity High
            Availability High

            See http://go.atlassian.com/cvss for more details.

            https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

            Sparsh added a comment - This is an independent assessment and you should evaluate its applicability to your own IT environment. CVSS v3 score: 9.1 => Critical severity Exploitability Metrics Attack Vector Network Attack Complexity Low Privileges Required High User Interaction None Scope Metric Scope Changed Impact Metrics Confidentiality High Integrity High Availability High See http://go.atlassian.com/cvss for more details. https://asecurityteam.bitbucket.io/cvss_v3/#CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

              Unassigned Unassigned
              sraj2@atlassian.com Sparsh
              Affected customers:
              0 This affects my team
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: