CVE-2023-1718: 
Homebrew vulnerability analysis and mitigation

Bitrix24 version 22.0.300 contains an improper file stream access vulnerability in the /desktopapp/file.ajax.php?action=uploadfile endpoint. The vulnerability, identified as CVE-2023-1718, was discovered by researchers from STAR Labs SG Pte. Ltd. and publicly disclosed on November 1, 2023. This security flaw allows unauthenticated remote attackers to cause a denial-of-service condition via a crafted 'tmpurl' parameter (STAR Labs).

The vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition - 'Infinite Loop') with a CVSS v3.1 Base Score of 7.5 (High). The issue occurs in the file upload functionality where files can be specified by their URL in the tmp_url field. When processing these URLs, the application fails to properly validate PHP streams, particularly when handling php://stdout, resulting in an infinite loop condition as the EOF marker is never reached. This occurs because php://stdout is a write-only stream, causing !feof($fp) to always return true (STAR Labs).

When successfully exploited, the vulnerability results in a denial-of-service condition through excessive computing resource consumption. The affected webserver becomes unresponsive as the process handling the malicious request consumes maximum allowed compute time, preventing the processing of legitimate requests. The impact is particularly severe as it affects availability while requiring no authentication to exploit (STAR Labs).

Detection of exploitation attempts can be implemented by monitoring traffic logs for the presence of php://stdout or file:///dev/stdout in request bodies. Organizations should examine their logs for these indicators of compromise and implement appropriate filtering mechanisms (STAR Labs).

The vendor, Bitrix24, initially expressed concerns about publishing the CVE, citing previous incidents where disclosure led to attacks on their clients. They attempted to negotiate an alternative resolution through a bug bounty program but ultimately agreed to a coordinated disclosure date of November 1, 2023 (STAR Labs).