Vulnerability · Published Nov 1, 2023 · Assigned by STAR_Labs

CVE-2023-1714Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction

High 8.8

In plain English

A high-severity unsafe deserialization in Bitrix24 from Bitrix24. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.8%top 22.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Unsafe variable extraction in bitrix/modules/main/classes/general/user_options.php in Bitrix24 22.0.300 allows remote authenticated attackers to execute arbitrary code via (1) appending arbitrary content to existing PHP files or (2) PHAR deserialization.

Affected products (as reported)

Vendor	Product	Versions
Bitrix24	Bitrix24	0 – through 22.0.300

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://starlabs.sg/advisories/23/23-1714/ third-party-advisory