CVE-2024-34891
📋 TL;DR
This vulnerability allows remote administrators to read Exchange account passwords stored in DAV server settings via HTTP GET requests. It affects Bitrix24 installations running version 23.300.100. The issue stems from insufficient credential protection in the web interface.
💻 Affected Systems
- 1C-Bitrix Bitrix24
📦 What is this software?
Bitrix24 by Bitrix24
⚠️ Risk & Real-World Impact
Worst Case
Administrators with malicious intent could steal Exchange account credentials, leading to email account compromise, data exfiltration, and lateral movement into connected systems.
Likely Case
Privileged users could access sensitive Exchange passwords, potentially enabling unauthorized email access and credential reuse attacks.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized administrators who should already have legitimate access to some system functions.
🎯 Exploit Status
Exploitation requires administrator credentials. GitHub repository contains proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later than 23.300.100
Vendor Advisory: http://bitrix24.com
Restart Required: No
Instructions:
1. Log into Bitrix24 admin panel
2. Check for available updates
3. Apply latest security patch
4. Verify DAV server settings no longer expose credentials
🔧 Temporary Workarounds
Disable DAV Server
allTemporarily disable DAV server functionality if Exchange integration is not required
Restrict Admin Access
allLimit administrator accounts to only trusted personnel and implement multi-factor authentication
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Bitrix24 from Exchange servers
- Rotate all Exchange account passwords and monitor for unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check if running version 23.300.100 and test HTTP GET requests to DAV server endpoints for credential exposureCheck Version:
Check Bitrix24 admin panel → Settings → AboutVerify Fix Applied:
Verify version is updated beyond 23.300.100 and test that same endpoints no longer return credentials📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP GET requests to DAV server endpoints
- Multiple failed authentication attempts followed by successful admin login
Network Indicators:
- HTTP traffic patterns matching known exploit paths
- Unexpected outbound connections to Exchange servers
SIEM Query:
source="bitrix24" AND (uri_path="/bitrix/admin/*dav*" OR uri_path="/bitrix/services/*dav*") AND status=200 AND response_size>1000