Loading story…
STAR Labs disclosed two high-severity vulnerabilities in Bitrix24 22.0.300, including CVE-2023-1713, which can lead to remote code execution on Apache-hosted deployments. The RCE issue affects the Instagram import feature, where an authenticated low-privilege user can control the basename of a downloaded file and create a malicious .htaccess file in the Bitrix upload directory. Because Apache honors .htaccess directives there, an attacker can make uploaded content executable as PHP and gain code execution after locating the randomized temporary subdirectory; researchers said the file can be kept in place long enough for brute-force discovery by slowly streaming data.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
On 2023-11-01, STAR Labs SG published an advisory for CVE-2023-1720, a high-severity Bitrix24 22.0.300 unrestricted file upload flaw that can cause stored XSS and, in some cases, lead to server-side code execution. The disclosure said unauthenticated attackers could upload attacker-controlled files via the upload endpoint and abuse administrator access to reach arbitrary command execution through Bitrix24’s PHP Command Line feature.
On 2023-11-01, STAR Labs SG published an advisory for CVE-2023-1714, a high-severity authenticated remote code execution flaw in Bitrix24 22.0.300. The disclosure detailed two exploitation paths tied to unsafe restoration of attacker-controlled export settings from the BITRIX_SM_LAST_SETTINGS cookie and included proof-of-concept exploits and detection guidance.
On 2023-11-01, STAR Labs SG publicly released advisories for two Bitrix24 22.0.300 vulnerabilities: CVE-2023-1713, an authenticated RCE issue, and CVE-2023-1718, an unauthenticated denial-of-service flaw in the file upload endpoint. The disclosures included technical details, detection guidance, and proof-of-concept information for defenders and researchers.
In March 2023, STAR Labs SG reported CVE-2023-1713 to Bitrix. The vulnerability affects Bitrix24 22.0.300 and can allow authenticated low-privilege users to achieve remote code execution on Apache-hosted deployments via insecure temporary file creation in the Instagram import feature.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourcestarlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs disclosed three Bitrix24 vulnerabilities affecting version `22.0.300` that can expose data and enable code execution. `CVE-2023-1715` and `CVE-2023-1716` affect the CRM invoice edit page, where improper sanitization of the `USER_DESCRIPTION` field allows a stored XSS payload to be saved and triggered when a user opens the invoice. The bypass relies on flawed handling of input beginning with `<` and JavaScript escaping weaknesses involving the Unicode paragraph separator `U+2029`. Exploitation requires an authenticated user with CRM access and invoice edit permissions, and successful compromise of an administrator can lead to abuse of Bitrix24’s built-in PHP Command Line feature to run arbitrary PHP or system commands on the server. A separate flaw, `CVE-2023-1719`, stems from insecure global variable extraction in `bitrix/modules/main/tools.php` and can be exploited without authentication. Researchers said the bug allows attackers to influence uninitialized variables through GET, POST, or Cookie data, enabling both IDOR-based attachment enumeration via `/pub/im.file.php` and reflected XSS via `/bitrix/components/bitrix/socialnetwork.events_dyn/get_message_2.php`. The reflected XSS also uses a `U+2029` sanitizer bypass and, if executed in an administrator’s browser, can similarly be chained into server-side command execution through the platform’s PHP command functionality.
Jun 29, 2026
CERT Polska disclosed four vulnerabilities in the Bludit content management system, including an unrestricted file upload flaw tracked as **CVE-2026-25099** that can lead to remote code execution, a stored XSS issue in image upload handling (**CVE-2026-25100**), a session fixation weakness that can enable session hijacking (**CVE-2026-25101**), and a separate stored XSS flaw in page creation tracked as **CVE-2026-4420**. The vulnerabilities were reported by researchers Arkadiusz Marta and Yassin Abdelrazek and affect multiple Bludit versions, with **CVE-2026-25099** impacting all releases before `3.18.4`, **CVE-2026-25101** affecting versions before `3.17.2`, **CVE-2026-25100** affecting all versions through `3.18.2`, and **CVE-2026-4420** confirmed in `3.17.2` and `3.18.0`. The XSS flaws can be exploited by authenticated users with content or page creation privileges by injecting malicious JavaScript into uploaded SVG content or article tags, with payloads executing when victims access publicly reachable resources without authentication. CERT Polska said the page-creation XSS could be used to automatically create a new site administrator if the victim has sufficient privileges, while the file upload issue could allow direct server-side compromise through remote code execution. The agency also said vendor coordination was incomplete, noting the vendor stopped responding or did not provide details on remediation and affected version ranges, raising uncertainty over whether some future releases may remain vulnerable.
Jun 29, 2026
Attackers are actively scanning for and attempting to exploit critical Apache Struts file upload vulnerabilities `CVE-2024-53677` and `CVE-2023-50164`, both of which stem from improper handling of upload parameters that can enable path traversal and unauthorized file placement. Security researchers reported internet-wide enumeration and exploitation activity following public disclosure and the appearance of proof-of-concept code on GitHub and in technical write-ups, with attackers seeking to upload malicious files into restricted directories. Successful exploitation can allow deployment of JSP web shells and lead to remote code execution on vulnerable Struts applications, depending on how file upload features are exposed and sanitized in each environment. The flaws affect multiple Struts branches, including legacy 2.x and 6.x releases, and defenders have been urged to upgrade to fixed versions such as Struts `2.5.33`, `6.3.0.2`, or `6.4.0` as applicable, migrate away from legacy upload mechanisms, restrict access to upload interfaces, apply WAF protections, and monitor for suspicious JSP file creation and execution.
Aug 21, 2026