CVE-2020-36233
📋 TL;DR
This vulnerability allows local attackers to escalate privileges on systems running vulnerable versions of Atlassian Bitbucket Server and Data Center due to weak permissions on the installation directory. Attackers with local access can exploit this to gain higher privileges than intended. This affects organizations using the Microsoft Windows Installer for Bitbucket Server/Data Center.
💻 Affected Systems
- Atlassian Bitbucket Server
- Atlassian Bitbucket Data Center
📦 What is this software?
Bitbucket by Atlassian
Bitbucket by Atlassian
Bitbucket by Atlassian
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full administrative control over the Bitbucket instance, potentially compromising source code, credentials, and deployment pipelines.
Likely Case
Local user or compromised service account escalates privileges to modify Bitbucket configuration, access sensitive data, or execute arbitrary code.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized configuration changes that can be detected and reverted.
🎯 Exploit Status
Requires local access to the Windows system. Exploitation involves manipulating files in the weakly-permissioned installation directory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.10.9, 7.6.4, or 7.10.1 and later
Vendor Advisory: https://jira.atlassian.com/browse/BSERV-12753
Restart Required: Yes
Instructions:
1. Download the patched version from Atlassian's website. 2. Stop the Bitbucket service. 3. Run the installer to upgrade. 4. Restart the service.
🔧 Temporary Workarounds
Restrict installation directory permissions
windowsManually tighten permissions on the Bitbucket installation directory to prevent unauthorized write access.
icacls "C:\Program Files\Atlassian\Bitbucket" /inheritance:r /grant:r "Administrators:(OI)(CI)F" /grant:r "SYSTEM:(OI)(CI)F" /grant:r "<Bitbucket_Service_Account>:(OI)(CI)RX"
🧯 If You Can't Patch
- Implement strict access controls to limit local user access to Bitbucket servers.
- Monitor file system changes in the Bitbucket installation directory using Windows auditing or security tools.
🔍 How to Verify
Check if Vulnerable:
Check Bitbucket version via web interface (Admin > System Info) or command line: "%BITBUCKET_HOME%\bin\bitbucket.bat version"Check Version:
"%BITBUCKET_HOME%\bin\bitbucket.bat version"Verify Fix Applied:
Confirm version is 6.10.9+, 7.6.4+, or 7.10.1+ and verify installation directory permissions are properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unexpected file modifications in Bitbucket installation directory
- Unusual service account privilege escalation attempts
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
EventID=4663 AND ObjectName LIKE "%Bitbucket%" AND Accesses="WriteData" OR "AppendData"