Authenticated Remote Code Execution in Bitrix24 PHP Admin Interface

Executive Summary

CVE-2022-50911 is an authenticated remote code execution vulnerability in Bitrix24. It allows attackers who are logged in with valid credentials to execute arbitrary system commands on the server by sending specially crafted POST requests to the PHP command line administrative interface. This happens because of missing authorization checks in the admin interface, enabling attackers to run code with the same privileges as the web application. [1, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker to execute arbitrary system commands on the server hosting Bitrix24, potentially leading to full control over the server environment. This can result in unauthorized access, data theft, system compromise, privilege escalation, and disruption of services. [1, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to authenticate to the Bitrix24 instance and then sending crafted POST requests to the /bitrix/admin/php_command_line.php endpoint to execute system commands. A practical detection method involves using a script similar to the one described in Resource 3, which logs in, retrieves the session ID, and sends commands to the PHP command line interface. Commands to test might include simple system commands like 'whoami' or 'id' executed via POST requests to verify if arbitrary command execution is possible. [3]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the PHP command line administrative interface to trusted users only, ensuring proper authorization checks are in place, and applying any available patches or updates from Bitrix24 that address this vulnerability. Additionally, monitoring and limiting authenticated user privileges can reduce the risk of exploitation. [1]

Useful 0 Not Useful 0