PT-2020-13567
CVE-2020-13484
·
تاريخ النشر
2020-06-24
·
تاريخ التحديث
2025-11-15
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Bitrix24 versions prior to 20.0.976
Description
The issue allows for Server-Side Request Forgery (SSRF) via an intranet IP address in the "services/main/ajax.php?action=attachUrlPreview" API endpoint, specifically through the
url parameter. This occurs when the destination URL hosts an HTML document containing a '<meta name="og:image" content="' tag followed by an intranet URL.Recommendations
For Bitrix24 versions prior to 20.0.976, as a temporary workaround, consider restricting access to the "services/main/ajax.php?action=attachUrlPreview" API endpoint until a patch is available. Avoid using the
url parameter in this endpoint with potentially malicious URLs.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾