Vulnerability · Published Nov 1, 2023 · Assigned by STAR_Labs
CVE-2023-1717Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
Critical 9.6
In plain English
A critical-severity cross-site scripting in Bitrix24 from Bitrix24. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)1.5%top 26.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.
Affected products (as reported)
Weakness: CWE-79, CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://starlabs.sg/advisories/23/23-1717/ third-party-advisory