PT-2015-2905 · 1С Битрикс · Bitrix.Mpbuilder

Published 2015-12-16 · Updated 2018-10-09 · CVE-2015-8358

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions bitrix.mpbuilder module versions prior to 1.0.12

Description The issue exists due to insufficient restriction of the directory path name in the bitrix.mpbuilder module of the 1С-Битрикс system. Exploitation of this issue may allow a remote attacker to include and execute arbitrary local files by adding ".." symbols to the directory name in the "work" array parameter to the "admin/bitrix.mpbuilder step2.php" endpoint.

Recommendations For versions prior to 1.0.12, update to version 1.0.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the "admin/bitrix.mpbuilder step2.php" endpoint to minimize the risk of exploitation. Avoid using the work array parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2016-00002

CVE-2015-8358

Affected Products

Bitrix.Mpbuilder

References · 8

• 🔥 https://htbridge.com/advisory/HTB23281 · Exploit
• 🔥 http://packetstormsecurity.com/files/134766/bitrix.mpbuilder-Bitrix-1.0.10-Local-File-Inclusion.html · Exploit
• 🔥 https://exploit-db.com/exploits/38975 · Exploit
• https://bdu.fstec.ru/vul/2016-00002 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8358 · Security Note
• https://marketplace.1c-bitrix.ru/solutions/bitrix.mpbuilder/#tab-log-link · Note
• http://securityfocus.com/archive/1/archive/1/537067/100/0/threaded · Note
• http://securityfocus.com/archive/1/537067/100/0/threaded · Note