CVE-2023-1720 - CVE House

Back to Database

Status published Critical CVE-2023-1720

Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload

9.6 CVSS

Vulnerability Description

Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1720

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Lam Jun Rong & Li Jiantao of STAR Labs SG Pte. Ltd. (@starlabs_sg)

References

https://starlabs.sg/advisories/23/23-1720/

More from Bitrix24

View All →

Bitrix24 Insecure Global Variable Extraction

Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access

Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution

Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)

Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)

Affected Vendor

Bitrix24

View all reports →

Affected Software

Bitrix24

Vulnerable Versions:

0

Timeline

Official Publish: November 1st, 2023

Last Modified: September 5th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation