CVE-2023-1719 Bitrix24 Insecure Global Variable Extraction
Unauthenticated attackers can execute arbitrary JavaScript or potentially PHP code by exploiting insecure global variable extraction in Bitrix24.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1719?
CVE-2023-1719 is a high-severity code injection vulnerability in Bitrix24, published on 1 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.
Weakness: CWE-665
Which versions are affected by CVE-2023-1719?
It affects 1 product.
Products include Bitrix24 Bitrix24.
How do I fix CVE-2023-1719?
No fix has been published for CVE-2023-1719 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-1719 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1719 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Bitrix24
- CVE-2022-27228 Code injection in n/a
- CVE-2020-13484 Server-side request forgery in n/a
- CVE-2023-1717 Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution
- CVE-2023-1720 Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload
- CVE-2023-1715 Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)
Sources
Also known as GHSA-cvvq-2x6w-g26j.