EUVD-2025-209734
GHSA-73qc-9hmq-7x6f
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionNVD
Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website.
AnalysisAI
Remote code execution in Bitrix24 through version 25.100.300 allows authenticated users with SOURCE/WRITE permissions on the Translate Module to execute arbitrary PHP code by uploading malicious PHP and .htaccess files. The vulnerability exploits unrestricted file upload capability in a high-privilege context; while the vendor disputes this as intended behavior for administrative users, the low EPSS score (0.02%) and lack of evidence of active exploitation suggest this poses minimal real-world risk despite the moderate CVSS rating.
Technical ContextAI
Bitrix24's Translate Module implements file upload functionality for managing translated content. The vulnerability stems from improper file upload validation (CWE-434: Unrestricted Upload of File with Dangerous Type), allowing authenticated users to bypass restrictions by uploading both a PHP file and a .htaccess configuration file. The .htaccess file modifies Apache's handling of subsequent requests, enabling execution of uploaded PHP as code rather than serving it as static content. This is a classic Apache web server misconfiguration vector where directory-level directives can override global restrictions. The affected versions include Bitrix24 self-hosted deployments running through version 25.100.300.
RemediationAI
Upgrade Bitrix24 to a patched version released after 25.100.300 (exact version number not specified in available data; consult vendor release notes). Until a patch is available, restrict SOURCE/WRITE permissions on the Translate Module to only trusted administrators and disable file upload functionality in the Translate Module if not actively required. Configure Apache to reject .htaccess files in upload directories via server-level directives (e.g., <Directory /path/to/uploads> AllowOverride None </Directory>), preventing attackers from modifying handler rules. Alternatively, store uploaded translation files outside the web root and serve them through a PHP proxy script that performs content-type validation. Monitor upload directories for suspicious .htaccess and PHP file combinations. These controls trade administrative convenience for security but effectively neutralize this attack vector without disabling the Translate Module entirely.
Share
External POC / Exploit Code
Leaving vuln.today