Li Jiantao

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

An authenticated remote attacker with valid administrative credentials can perform SQL or HQL (Hibernate Query Language) injection attacks. This issue stems from insufficient validation of user-supplied input sent to affected APIs before the input is used to construct database queries. By sending a crafted request, an attacker can execute arbitrary queries against the underlying database to view or modify unauthorized data.

An internal service in the affected software lacks proper authentication on the Policy Runtime Repository Table (PRRT) service. This allows an unauthenticated remote attacker to retrieve sensitive configuration information by sending a crafted request to the device.

A flaw in the client provisioning download feature allows an unauthenticated remote attacker to access protected files. The issue stems from insufficient validation of directory traversal character sequences—a technique used to access files and directories outside the intended folder—within a user-supplied path during the processing of provisioning resource requests. An attacker can exploit this by sending a crafted request to the provisioning download service to expose sensitive information.

Insufficient validation of user-supplied input in the certificate import functionality of the web-based management interface allows an authenticated remote attacker with administrative credentials to read arbitrary files from the affected system. This is achieved by sending a crafted request to the management interface, potentially exposing sensitive information.

An issue exists in the endpoint posture status reporting functionality of the guest portal web application. This is caused by insufficient authentication on an internal interface exposed through the guest portal, which allows an unauthenticated remote attacker to submit forged posture status events into the endpoint posture pipeline by sending a crafted request. A successful exploit enables the attacker to manipulate the posture status on the affected system.

An issue in an API of Cisco ISE and Cisco ISE-PIC allows an authenticated, remote attacker to read specific files on the underlying operating system. This occurs due to improper restriction of XML external entity (XXE) references, where XXE is a type of attack that occurs when an XML parser improperly processes external entity references within an XML document. An attacker can exploit this by sending a crafted request to the affected device to access files that the underlying process has permission to read.

An issue exists in the Online Certificate Status Protocol (OCSP) responder—a protocol used for obtaining the real-time revocation status of digital certificates. The flaw is caused by missing authentication on a function of the OCSP responder, which allows an unauthenticated remote attacker to send a crafted request to an affected device. A successful exploit enables the attacker to trigger an administrative reload of the OCSP responder certificate and key material on demand.

An issue in the offline profiler feed service allows an authenticated remote attacker to read arbitrary files from the file system and send requests to internal systems. This occurs because the service uses an XML parser that fails to disable external entity resolution when processing attacker-controlled feed metadata. An attacker with valid administrative credentials can trigger this by uploading a specially crafted offline feed package via the administrative interface.

An issue in the REST API allows an authenticated remote attacker with administrative credentials to perform SQL injection attacks against the monitoring database. This occurs because the system fails to sufficiently validate specific parameters before concatenating them into an SQL statement. An attacker can exploit this by sending a crafted request containing SQL statements in the affected parameters to read information from the monitoring database.

Inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, allows for admin account takeover. This occurs when a front-end server and a back-end server disagree on the boundaries of an HTTP request, potentially allowing an attacker to "smuggle" a request to the back-end.

Insufficient validation of user-supplied input allows an authenticated remote attacker with valid administrative credentials to execute arbitrary commands on the underlying operating system of an affected device. This is achieved by sending a crafted HTTP request. A successful exploit can grant user-level access to the operating system, which can then be elevated to root privileges. In single-node deployments, this may lead to a denial of service (DoS) condition, rendering the node unavailable and preventing unauthenticated endpoints from accessing the network.

The issue is related to the transmission of credentials in cleartext, which may allow a remote attacker to capture packets and craft their own requests, potentially leading to unauthorized access to protected information. This could enable an attacker to bypass authentication.

An issue exists in the component `bitrix/modules/crm/lib/order/import/instagram.php` of Bitrix24 that stems from insufficient protection of web page structure. Exploitation of this issue could allow a remote attacker to execute arbitrary code by uploading a specially crafted ".htaccess" file. The issue allows for privilege escalation. The vulnerability is tracked as CVE-2023-1713. No information is available regarding the number of potentially affected devices worldwide or any real-world incidents where this issue has been exploited. The vulnerability involves insecure temporary file creation. The vulnerable file is located at `bitrix/modules/crm/lib/order/import/instagram.php`.

An unsafe variable extraction issue exists in the `bitrix/modules/main/classes/general/user options.php` file. This allows remote authenticated attackers to execute arbitrary code through two methods: appending arbitrary content to existing PHP files, or PHAR deserialization. The issue involves incorrect external control of the file name or path. Exploitation may allow an attacker to execute arbitrary code and elevate privileges.

The issue is related to the lack of a mime type response header in Bitrix24, which allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also possible to execute arbitrary PHP code on the server. This can be achieved by uploading a crafted HTML file through the "/desktop app/file.ajax.php?action=uploadfile" endpoint.

The issue in Bitrix24 is related to global variable extraction in the bitrix/modules/main/tools.php component, allowing unauthenticated remote attackers to enumerate attachments on the server and execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also possible to execute arbitrary PHP code on the server. This is achieved via overwriting uninitialized variables.

An improper file stream access issue exists in the `/desktop app/file.ajax.php?action=uploadfile` component of Bitrix24. This allows unauthenticated remote attackers to cause a denial-of-service condition by using a crafted `tmp url`. The issue is related to a loop with an inaccessible exit condition. The affected API endpoint is `/desktop app/file.ajax.php` with the `action` parameter set to `uploadfile`. The vulnerable parameter is `tmp url`.

The issue is related to prototype pollution in the bitrix/templates/bitrix24/components/bitrix/menu/left vertical/script.js component of Bitrix24. This allows remote attackers to execute arbitrary JavaScript code in the victim's browser and possibly execute arbitrary PHP code on the server if the victim has administrator privileges. The exploitation is done by polluting ` proto [tag]` and ` proto [text]`.