Critical · published November 1, 2023
🔥 A sneaky prototype pollution vulnerability in Bitrix24 could allow attackers to run arbitrary JavaScript on users’ browsers — and even PHP code on servers with admin privileges! 🚨 Think of it like an unauthorized diner slipping a note into the order system, altering what the kitchen prepares without the chefs noticing. If the head chef (the admin) gets the wrong order, the entire menu could be compromised! An attacker could exploit this vulnerability to execute malicious scripts in the victim's browser, leading to data theft or session hijacking. If that victim has administrative access, the situation could escalate into a total server takeover, putting sensitive information at grave risk.
Think of it like an unauthorized diner slipping a note into the order system, altering what the kitchen prepares without the chefs noticing. If the head chef (the admin) gets the wrong order, the entire menu could be compromised! This vulnerability allows remote attackers to manipulate the JavaScript prototype chain by targeting `__proto__[tag]` and `__proto__[text]`, potentially leading to the execution of arbitrary code in both the user’s browser and on the server itself if the user has admin rights.
An attacker could exploit this vulnerability to execute malicious scripts in the victim's browser, leading to data theft or session hijacking. If that victim has administrative access, the situation could escalate into a total server takeover, putting sensitive information at grave risk. Update Bitrix24 to version 22.0.301 or later immediately to patch this vulnerability. Review your application’s security policies and consider implementing stricter input validation to prevent prototype pollution. Additionally, educate users about the risks of executing untrusted scripts. You’ve got this! With these steps, you can secure your Bitrix24 environment and keep it running smoothly. 🛡️