PT-2023-6687 · Bitrix+1 · Bitrix24+1

Lam Jun Rong + 1 · Published 2023-11-01 · Updated 2025-12-01 · CVE-2023-1714

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Bitrix24 version 22.0.300

Description An unsafe variable extraction issue exists in the bitrix/modules/main/classes/general/user options.php file. This allows remote authenticated attackers to execute arbitrary code through two methods: appending arbitrary content to existing PHP files, or PHAR deserialization. The issue involves incorrect external control of the file name or path. Exploitation may allow an attacker to execute arbitrary code and elevate privileges.

Recommendations Bitrix24 version 22.0.300: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-73

Related Identifiers

BDU:2023-07457

CVE-2023-1714

Affected Products

Bitrix

Bitrix24

References · 14

• 🔥 https://starlabs.sg/advisories/23/23-1714 · Exploit
• https://osv.dev/vulnerability/CVE-2023-1714 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1714 · Security Note
• https://bdu.fstec.ru/vul/2023-07457 · Security Note
• https://t.me/true_secator/7676 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1719747443707781497 · Twitter Post
• https://t.me/freedomf0x/20532 · Telegram Post
• https://1c-bitrix.ru/vul/18879796 · Note
• https://1c-bitrix.ru/vul/18880322 · Note
• https://t.me/apt_notes/971 · Telegram Post
• https://twitter.com/CVEnew/status/1719644487289344338 · Twitter Post
• https://t.me/pentestbacklog/195 · Telegram Post
• https://t.me/poxek/3380 · Telegram Post
• https://vuldb.com/ru/?id.244173 · Note