Lam Jun Rong

An improper neutralization of input during web page generation, known as Cross-site Scripting (XSS), occurs in the extract domain component. This allows remote authenticated users, through UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM. This issue may also expose users to session theft, credential compromise, or unauthorized actions within the application.

يسمح وجود ثغرة في تحليل طلبات HTTP/2 بشن هجوم عدم تزامن الطلبات الخلفية، المعروف أيضًا باسم تهريب الطلبات. وقد يؤدي ذلك إلى تسميم ذاكرة التخزين المؤقت، أو تجاوز المصادقة، أو الكشف عن المعلومات، أو التلاعب بالبيانات. لا يمكن استغلال هذه المشكلة إلا إذا تم تمكين دعم HTTP/2 عن طريق تكوين المعلمة `feature` لتشمل `+http2`. بشكل افتراضي، يكون دعم HTTP/2 معطلاً.

قد يؤدي الاستغلال الناجح لهذه الثغرة إلى تمكين المهاجم من تنفيذ أوامر عشوائية بصفة الجذر (root)، مما قد يؤدي إلى فقدان السرية والسلامة والتوافر، فضلاً عن السيطرة الكاملة على نقطة الوصول.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: لا يمكن تحديد اسم المنتج. الوصف: تسمح هذه الثغرة الأمنية لمهاجم غير معتمد بتحميل برنامج ثابت عبر صفحة تحديث عامة. وقد يؤدي ذلك إلى تثبيت باب خلفي أو تصعيد الصلاحيات. التوصيات: لا توجد في الوقت الحالي أي معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

The issue is related to prototype pollution in the bitrix/templates/bitrix24/components/bitrix/menu/left vertical/script.js component of Bitrix24. This allows remote attackers to execute arbitrary JavaScript code in the victim's browser and possibly execute arbitrary PHP code on the server if the victim has administrator privileges. The exploitation is done by polluting ` proto [tag]` and ` proto [text]`.

An unsafe variable extraction issue exists in the `bitrix/modules/main/classes/general/user options.php` file. This allows remote authenticated attackers to execute arbitrary code through two methods: appending arbitrary content to existing PHP files, or PHAR deserialization. The issue involves incorrect external control of the file name or path. Exploitation may allow an attacker to execute arbitrary code and elevate privileges.

An issue exists in the component `bitrix/modules/crm/lib/order/import/instagram.php` of Bitrix24 that stems from insufficient protection of web page structure. Exploitation of this issue could allow a remote attacker to execute arbitrary code by uploading a specially crafted ".htaccess" file. The issue allows for privilege escalation. The vulnerability is tracked as CVE-2023-1713. No information is available regarding the number of potentially affected devices worldwide or any real-world incidents where this issue has been exploited. The vulnerability involves insecure temporary file creation. The vulnerable file is located at `bitrix/modules/crm/lib/order/import/instagram.php`.

A logic error in the `mb strpos()` function allows attackers to bypass XSS sanitization by placing HTML tags at the beginning of the payload, potentially leading to a cross-site scripting (XSS) attack. This issue is related to the failure to neutralize scripts in attributes on web pages.

The issue is related to the lack of a mime type response header in Bitrix24, which allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also possible to execute arbitrary PHP code on the server. This can be achieved by uploading a crafted HTML file through the "/desktop app/file.ajax.php?action=uploadfile" endpoint.

The issue in Bitrix24 is related to global variable extraction in the bitrix/modules/main/tools.php component, allowing unauthenticated remote attackers to enumerate attachments on the server and execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also possible to execute arbitrary PHP code on the server. This is achieved via overwriting uninitialized variables.

An improper file stream access issue exists in the `/desktop app/file.ajax.php?action=uploadfile` component of Bitrix24. This allows unauthenticated remote attackers to cause a denial-of-service condition by using a crafted `tmp url`. The issue is related to a loop with an inaccessible exit condition. The affected API endpoint is `/desktop app/file.ajax.php` with the `action` parameter set to `uploadfile`. The vulnerable parameter is `tmp url`.