Auto-translation used
Read the original

Bitrix24 Recommendations: how to protect your data

Bitrix24 Kazakhstan, a leader in corporate communications and business management, pays special attention to technological security. In this article, we will look at what measures Bitrix24 recommends users to take to protect their data, prevent unauthorized access, and ensure reliable system operation.

The Bitrix24 Incident Monitoring Center, as part of the Secure Integrations project, is investigating cases of hacking sites that exploit vulnerabilities in solutions from third-party developers.

In April 2025, there were no cases of hacking, but as a preventive measure, due to the identified potential threat , it is urgently necessary to update outdated versions of the following solutions.

The vulnerabilities relate to modules submitted by two developers:

kda.importexcelImporting data from ExcelKDA Bitrix LLC (kdasoft.ru )
kda.exportexcelExporting data from ExcelKDA Bitrix LLC (kdasoft.ru )
esol.massediteMass editing of documentsEsol — Easy Solutions (esolutions.su)
esol.importxmlImporting XML filesEsol — Easy Solutions (esolutions.su)
esol.importexportexcelImport/Export ExcelEsol — Easy Solutions (esolutions.su)
esol.allimportexportAll types of import and exportEsol — Easy Solutions (esolutions.su)

Attackers use vulnerabilities in the administrative scripts of these modules to gain access to the server through cron scripts. This gives them the opportunity to download malicious files and execute arbitrary PHP code. In practice, even a single module that is not updated and with unlimited rights can become a vulnerable point in the system if it is granted open access and is not controlled.

1. Restore the correct access rights

Run the script to set secure permissions and file owners.: 

bash

#!/bin/bash
# Run from root!
DOCROOT="/home/bitrix/www"

FILES=(
    "/bitrix/modules/esol.allimportexport/admin/cron_settings.php"
    "/bitrix/modules/esol.importexportexcel/admin/iblock_export_excel_cron_settings.php"
    "/bitrix/modules/esol.importexportexcel/admin/iblock_import_excel_cron_settings.php"
    "/bitrix/modules/esol.importxml/admin/import_xml_cron_settings.php"
    "/bitrix/modules/esol.massedit/admin/profile.php"
    "/bitrix/modules/kda.exportexcel/admin/iblock_export_excel_cron_settings.php"
    "/bitrix/modules/kda.importexcel/admin/iblock_import_excel_cron_settings.php"
)

for file in "${FILES[@]}"
do
FULLPATH="$DOCROOT$file"
echo"Processed by: $FULLPATH"
    
    if [ ! -f "$FULLPATH" ]; then
        echo "Missing file: $FULLPATH"
continue
    fi

    chattr -i "$FULLPATH" 2>/dev/null
    chmod 644 "$FULLPATH"
    chown bitrix:bitrix "$FULLPATH"
    
    echo "Protected: $FULLPATH"
done

echo "Processing completed."

How to use: 

bash

wget -O fix_permissions.sh https://onehost.kz/fix_permissions
chmod +x fix_permissions.sh
./fix_permissions.sh

Additionally, it is recommended to apply a patch: 

bash

wget -O patch.php https://onehost.kz/patch

Copy the file patch.php go to the root of the site and open it in a browser: 

arduino

https://ваш_сайт/patch.php

, Please note: to perform the patch in PHP should have active phar support.

To summarize, vulnerabilities in third-party modules can compromise the integrity of your site. We recommend checking the installed modules, deleting unnecessary ones, restricting access to scripts, and applying additional security measures. Regular updates to the module will help you maintain a high level of security.

152
avatar

Ксения Рабинович

April 18, 2025 12:29

Comments 0

Login to leave a comment