CVE-2020-13484: 
Homebrew vulnerability analysis and mitigation

Bitrix24 through version 20.0.975 contains a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to access internal network resources via the url parameter in services/main/ajax.php?action=attachUrlPreview endpoint, when the destination URL contains an HTML document (GitHub Gist).

The vulnerability exists in the URL preview functionality accessed through services/main/ajax.php with the action=attachUrlPreview parameter. An attacker can exploit this by providing an internal IP address as the url parameter value, allowing them to make requests to the internal network, as long as the target URL returns an HTML document (FortiGuard).

This SSRF vulnerability could allow attackers to scan and access internal network resources that should not be accessible from external networks, potentially leading to information disclosure or further network compromise (GitHub Gist).

The vulnerability can be exploited by sending specially crafted requests to the affected endpoint with internal IP addresses as the URL parameter. The main prerequisite is that the target URL must host an HTML document (GitHub Gist).

Users should upgrade to a version newer than 20.0.975. Until an upgrade is possible, it is recommended to implement network segmentation and restrict access to internal resources through proper firewall rules (FortiGuard).