CVE-2022-50911
Authenticated Remote Code Execution in Bitrix24 PHP Admin Interface
Publication date: 2026-01-13
Last updated on: 2026-01-13
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bitrix | bitrix24 | * |
| bitrix | bitrix24_messenger | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2022-50911 is an authenticated remote code execution vulnerability in Bitrix24. It allows attackers who are logged in with valid credentials to execute arbitrary system commands on the server by sending specially crafted POST requests to the PHP command line administrative interface. This happens because of missing authorization checks in the admin interface, enabling attackers to run code with the same privileges as the web application. [1, 3]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker to execute arbitrary system commands on the server hosting Bitrix24, potentially leading to full control over the server environment. This can result in unauthorized access, data theft, system compromise, privilege escalation, and disruption of services. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to authenticate to the Bitrix24 instance and then sending crafted POST requests to the /bitrix/admin/php_command_line.php endpoint to execute system commands. A practical detection method involves using a script similar to the one described in Resource 3, which logs in, retrieves the session ID, and sends commands to the PHP command line interface. Commands to test might include simple system commands like 'whoami' or 'id' executed via POST requests to verify if arbitrary command execution is possible. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the PHP command line administrative interface to trusted users only, ensuring proper authorization checks are in place, and applying any available patches or updates from Bitrix24 that address this vulnerability. Additionally, monitoring and limiting authenticated user privileges can reduce the risk of exploitation. [1]