Bitbucket Server のセキュリティ勧告 2018-03-21

Bitbucket Server - Remote Code Execution via in Browser Editing - CVE-2018-5225

Note: As of September 2014 we are no longer issuing binary bug patches, instead we create new bug fix releases for the platform and feature versions we are backporting.

概要

CVE-2018-5225 - Bitbucket Server - Remote Code Execution via in Browser Editing

Advisory Release Date

 10 AM PDT (Pacific Time, -7 hours)

製品 Bitbucket Server

Affected Bitbucket Server Versions

  • 4.13.0 <= version < 5.4.8
  • 5.5.0 <= version < 5.5.8
  • 5.6.0 <= version < 5.6.5
  • 5.7.0 <= version < 5.7.3
  • 5.8.0 <= version < 5.8.2

Fixed Bitbucket Server Versions

  • 5.4.8
  • 5.5.8
  • 5.6.5
  • 5.7.3
  • 5.8.2
  • 5.9.0
CVE ID(s) CVE-2018-5225


Summary of Vulnerability

This advisory discloses a critical severity security vulnerability which was introduced in version 4.13.0 of Bitbucket Server. All versions of Bitbucket Server before  5.4.8 (the fixed version for 4.13.0 through to 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x) are affected by this vulnerability. Bitbucket Server 5.9.0 is not impacted by this vulnerability.


Customers who have upgraded Bitbucket Server to version 5.4.8, 5.5.8, 5.6.5, 5.7.3, 5.8.2 or 5.9.0 are not affected.

Customers who have downloaded and installed Bitbucket Server >= 4.13.0 less than 5.4.8 (the fixed version for 4.13.0 through to 5.4.7)

Customers who have downloaded and installed Bitbucket Server >= 5.5.0 less than 5.5.8 (the fixed version for 5.5.x)

Customers who have downloaded and installed Bitbucket Server >= 5.6.0 less than 5.6.5 (the fixed version for 5.6.x)

Customers who have downloaded and installed Bitbucket Server >= 5.7.0 less than 5.7.3 (the fixed version for 5.7.x)

Customers who have downloaded and installed Bitbucket Server >= 5.8.0 less than 5.8.2 (the fixed version for 5.8.x)


Please upgrade your Bitbucket Server installations immediately to fix this vulnerability.


Remote Code Execution via In Browser Editing

重大度

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.

This is our assessment and you should evaluate its applicability to your own IT environment.

説明

An authenticated user of Bitbucket Server could gain remote code execution using the in-browser editing feature via editing a symbolic link within a repository.

All versions of Bitbucket Server before 5.4.8 (the fixed version for 4.13.0 through to 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x) are affected by this vulnerability. Bitbucket Server 5.9.0 is not impacted by this vulnerability. This issue can be tracked here: https://jira.atlassian.com/browse/BSERV-10684 

Fix

We have taken the following steps to address this issue:

  1. Released Bitbucket Server version 5.9.0 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download.
  2. Released Bitbucket Server version 5.8.2 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
  3. Released Bitbucket Server version 5.7.3 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
  4. Released Bitbucket Server version 5.6.5 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
  5. Released Bitbucket Server version 5.5.8 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.
  6. Released Bitbucket Server version 5.4.8 that contains a fix for this issue and can be downloaded from https://www.atlassian.com/software/bitbucket/download-archives.

What You Need to Do

Atlassian recommends that you upgrade to the latest version. For a full description of the latest version of Bitbucket Server, see the release notes. You can download the latest version of Bitbucket Server from the download centre.


問題の緩和策

If you are running an affected version of Bitbucket Server and cannot upgrade to an unaffected version the following mitigation can be performed:

  1. Set feature.file.editor=false in the bitbucket.properties file

  2. Restart Bitbucket Server for changes to become effective

Please note that this mitigation does not mitigate against vulnerabilities where third party plugins use the file editing API programatically.


サポート

If you did not receive an email for this advisory and you wish to receive such emails in the future go to https://my.atlassian.com/email and subscribe to the Alerts emails.

If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/.

参考

Security Bug fix Policy

As per our new policy critical security bug fixes will be back ported in accordance with https://www.atlassian.com/trust/security/bug-fix-policy.  We will release new bug fix releases for the versions covered by the new policy instead of binary patches.

Binary patches are no longer released. 

Severity Levels for security issues Atlassian security advisories include a severity level and a CVE identifier. This severity level is based on our self-calculated CVSS score for each specific vulnerability. CVSS is an industry standard vulnerability metric. You can also learn more about CVSS at FIRST.org.
サポート終了ポリシー  Our end of life policy varies for different products. Please refer to our EOL Policy for details. 
最終更新日 2018 年 3 月 20 日

この内容はお役に立ちましたか?

はい
いいえ
この記事についてのフィードバックを送信する
Powered by Confluence and Scroll Viewport.