bitrixprobe - Open-source vulnerability assessment toolkit for 1

项目说明

English | Русский

BitrixProbe

!logo

BitrixProbe is a assessment tool for CMS 1C-Bitrix/Bitrix24 installations. It is written in Python.

It is designed around two separate assessment modes:

Legal Disclaimer & Responsible Use

BitrixProbe is intended only for authorized security testing, internal audits, research, and defensi.

Please see DISCLAIMER for the full legal disclaimer.

Why I Built BitrixProbe

I started BitrixProbe after facing a recurring problem in scanning and remediation approval.

Bitrix-based systems are often heavily modified by web de and integrators. These custom changes can make
remediation slow, risky, or difficult to appro in corporate en where business logic
depends on legacy code and custom modules.

As a result, code exist in production for a long time. In many cases, security teams do not have
enough into which Bitrix components are exposed, which modules are installed, or which issues
require urgent attention.

The first idea behind BitrixProbe was simple: build a small Python tool that keeps external web checks and
authenticated ser checks separate, collects useful e, and produces reports that are practical
during real security assessments.

BitrixProbe is still e. Some checks focus on fingerprinting and exposure detection, while others are
designed as probes or local audit checks.

Features

Tested En

BitrixProbe was de and tested in a controlled lab en.

| Target OS | PHP | Web Server | Bitrix / Edition |
|--------------------------------------------------------------------| --- | --- |--------------------------|
| Ubuntu 24.04.4 LTS / 6.8.0-117-generic aarch64 Linux | PHP 8.3.6 | Apache/2.4.58 | 1C-Bitrix/Bitrix24 26.150.0 |
| 9.0.9 CentOS Stream 9 / 5.14.0-710.el9.x86_64 Linux | PHP 8.2.31 | Apache/2.4.62<br/>nginx/1.30.2 | Bitrix24 26.150.0 |
| 9.0.9 AlmaLinux 9.7 / 5.14.0-611.26.1.el9_7.x86_64 Linux | PHP 8.2.30 | Apache/2.4.62<br/>nginx/1.28.1 | Bitrix24 26.150.0 |
| 9.0.9 Rocky Linux 9.7 / 5.14.0-611.24.1.el9_7.x86_64 Linux | PHP 8.2.30 | Apache/2.4.62<br/>nginx/1.28.1 | Bitrix24 26.150.0 |
| RED OS 8.0.2 / 6.12.92-1.red80.x86_64 Linux | PHP 8.4.19 | nginx/1.30.2 | Bitrix24 26.150.0 |

Modes

| Mode | Protocol | Description | Authentication | Typical Use |
| --- |----------------| --- | --- | --- |
| pentest | TCP HTTP/HTTPS | External HTTP/HTTPS scans against a target URL. | Not required | Public exposure checks, fingerprinting, unauthenticated probes. |
| audit | TCP SSH, SFTP | Local ser over SSH. | Required | Installed module checks, local configuration review, comparison. |

Scan Examples

BitrixProbe prints each module result while the scan is running and saves the
same human-readable e in a report. The following examples explain the
information produced by pentest and audit scans.

Pentest Scan

Pentest modules perform external HTTP/HTTPS checks without requiring access to
the target server. For example, the restore.php exposure check can identify a
publicly reachable Bitrix backup restoration script.

!restore.php

The module reports the tested URL, HTTP response metadata, and the Bitrix markers that confirmed the finding.
A positive Detected: yes result means the module found matching e.

Recon and enumeration are key in any attack. With this in mind, for security, it is important to understand what
configurations and components are deployed and accessible to the attacker.
Bitrix has many modules that occasionally contain .
It is a good idea to try to identify which modules are installed in Bitrix.
For this, I've made an enumeration check that compares present static files accessible on the web server
with a wordlist. Its results might gi about which default modules are present on the filesystem and installed.
By identifying plugins, it is possible to determine whether it is a 1C-Bitrix or Bitrix24 of the CMS.
Below, we can see that the landing module is likely installed, and the CMS appears to be 1C-Bitrix CMS.

!modules

Audit Scan

Audit modules run authenticated ser checks through SSH. For example,
an audit check can compare installed Bitrix module with the local
database. Below are some results for present and installed modules, as well as outdated .
Some module information might be missing from the database because the does not share all data on their website.

!amodules

The result below shows the installed module , identifiers,
se, and the containing the fix. For example, it displays the PT-Trending red flag, which signals
that this is actively exploited in CIS. It is similar to the US CISA KEV.
There is also an EPSS metric, but it is a only if CVE is present.
Many do not have CVE but instead have BDU.

!avulns

Result Statuses

| Output | Meaning |
| --- | --- |
| Detected: yes | The module completed and found matching e. |
| Detected: no | The module completed successfully but did not find the condition. |
| Check skipped | A required dependency was una or was not detected. |
| Failed | A technical error pre the module from completing normally. |

Installation

Clone the repository and install the Python dependencies from the project root:

Run BitrixProbe from the repository root:

Usage

Run external pentest scans:

Run authenticated ser audit scans over SSH:

Reports are saved to the reports/ directory by default.

En File

BitrixProbe can read SSH audit connection settings from a .env file. This is
useful for audit mode because the SSH password is not accepted as a command-line
argument.

Create a .env file in the project root:

Set strict file permissions before running audit mode:

BitrixProbe checks the .env file permissions before loading it. The file must
not be a symlink, and the expected permission mode is 640. If the file has
different permissions, BitrixProbe stops and prints the required chmod command.

Use the default .env file:

Use a custom en file:

CLI o .env for SSH host, port, and username:

If host, port, username, or password are still missing after reading CLI options
and the .env file, BitrixProbe asks for them interactively.

Options

Show the main help:

Show pentest mode help:

| Option | Required | Description |
| --- | --- | --- |
| --url | Yes | Target URL, for example or . If no scheme is provided, BitrixProbe uses https://. |

Show audit mode help:

| Option | Required | Description |
| --- | --- | --- |
| -H, --host | No | SSH ser. O BP_SSH_HOST from the .env file. |
| -p, --port | No | SSH server port. O BP_SSH_PORT; defaults to 22 if not provided. |
| -u, --user | No | SSH username. O BP_SSH_USER from the .env file. |
| --en | No | Path to the en file. Defaults to .env. |
| --webroot | No | Remote Bitrix webroot directory. Defaults to /var/www/html. |
| --output-dir | No | Local directory for report files. Defaults to reports. |

Using BitrixProbe with Docker

Build the Docker image from the BitrixProbe project root. The build context
must contain both Dockerfile and requirements.txt:

Run BitrixProbe from Docker with the current host directory mounted as /app.
This keeps the local .env file outside the image and sa to
$(pwd)/reports on the host:

Run external web scans with a URL:

If the target uses a local hostname, map it to the target IP for the container:

Run SSH audit mode with a host/IP and port. Do not pass an HTTP URL to
audit --host:

For audit mode with a local .env file, keep .env in the current directory
and mount the directory into the container:

Docker and

If the target Bitrix installation is inside a VM, the container may not be able to
resolve or route to the VM even when the host machine can. A DNS error such as
Name does not resolve means the container cannot resolve the hostname. Use
--add-host or pass the target IP directly.

If the target IP also does not connect from inside the container, the issue is
network reachability. On Linux Docker Engine, try host networking:

On Docker Desktop for macOS or Windows, --net=host usually does not provide
direct access to host-only . Use one of these approaches instead:

Example SSH tunnel from the host for audit scans:

Then run the container against the forwarded SSH port:

For pentest --url, forward the VM web port through SSH from the host. This is
useful when the host can reach the VM, but the Docker container cannot route to
the directly.

Forward HTTP from the VM to local port 8080:

Then scan the forwarded URL from Docker:

For HTTPS, forward VM port 443 to local port 8443:

Then scan:

Very often web server and Bitrix site will require a specific domain name, because there might be domain configuration on web server. Keep the tunnel and add a host
mapping for the container. On macOS/Linux Docker Engine:

Also, there are some commands to test network access from inside the container:

>* - a target url

List

Detection status legend

Detection status

| Detected | Title | Module | Se | Vuln ID | SSH Audit | Pentest Scan <br/>HTTP/S |
|:----------:|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-------------------:|:--------:|:-----------------------------:|:-----------------------------------------------------------------------------------:|:----------------------------------------------------------------------------------------:|
| X | Exposed Bitrix restore.php backup restore script detection | X | 10 | | !YES | !YES |
| X | Exposed Bitrix bitrixsetup.php installer script detection | X | Exposure | | !YES | !YES |
| 08.01.2026 | Local file inclusion when editing a landing page | landing | 9.8 | BDU:2026-05965 | !YES| !NO Authenticated |
| 07.04.2026 | Unauthorized access to information about mail settings | main | 8.5 | BDU:2026-04276 | !YES| !YES Unauthenticated |
| 30.08.2025 | By filling out a crm form, an attacker can add extraneous content <br/>to the text of linked email newsletters | crm | 3.1 | BDU:2025-15620 | !YES| !NO |
| 21.04.2025 | Local File Inclusion when changing infoblock properties | iblock | 8 | BDU:2025-08666 | !YES| !NO |
| 21.04.2025 | Reading arbitrary files when importing xml info block | iblock | 6.9 | BDU:2025-08665 | !YES| !NO |
| 21.04.2025 | Reading arbitrary files when importing an info block | iblock | 6.9 | BDU:2025-08664 | !YES| !NO |
| 17.04.2025 | Exceeding pri when editing mail templates | main | 7.1 | BDU:2025-08663 | !YES| !NO |
| 17.04.2025 | Exceeding the limits when copying files | fileman | 7.1 | BDU:2025-08662 | !YES| !NO |
| 05.08.2024 | In a machine, it is possible to elevate bitrix->root pri | | 8 | BDU:2025-04604 | !NO | !NO |
| 16.12.2024 | In a machine, it is possible to elevate bitrix->root pri | | 8 | BDU:2025-04539 | !NO | !NO |
| 03.12.2024 | Stored XSS bypassing proacti in forum functionality | ui | 8 | BDU:2025-00765 | !YES| !NO |
| 24.04.2024 | (Authenticated) The system administrator can retrieve the pre set password to the proxy server | dav | 6,8 | BDU:2024-08613<br/>C | !YES| !NO Authenticated |
| 24.04.2024 | (Authenticated) The system administrator can retrieve a pre set SMTP password | main | 6,8 | BDU:2024-08612<br/>C | !YES| !NO Authenticated |
| 24.04.2024 | (Authenticated) The system administrator can retrieve a pre set Exchange password | dav | 6,8 | BDU:2024-08611<br/>C | !YES| !NO Authenticated |
| 24.04.2024 | (Authenticated) The system administrator can retrieve a pre set SMTP password | main | 6,8 | BDU:2024-08610<br/>C | !YES| !NO Authenticated |
| 24.04.2024 | (Authenticated) The system administrator can retrieve a pre set Acti password | ldap | 6,8 | BDU:2024-08600<br/>C | !YES| !NO Authenticated |
| 02.07.2024 | (Rejected CVE) If attackers use the machine installer before the administrator does, <br/>they can gain control of the server. | Ver. 7.5.5 | | BDU:2024-05252<br/>C | !NO | !NO |
| 07.12.2023 | The bitrixsetup.php installation script did not escape an error message containing user input. <br/>Due to the lack of input parameter , it is possible to read files in the operating system. | bitrixsetup.php | 3 | BDU:2024-01501 | !NO | !YES |
| 30.03.2023 | (Authenticated) [RCE] Bitrix24 related to errors in the data import mechanism. <br/>Exploitation of this allows an internal attacker to increase his pri in the system. | crm | 8.8 | BDU:2023-07464<br/>C | !YES| !NO Authenticated |
| 30.03.2023 | (Authenticated) Stored Cross-Site Scripting [XSS] Bitrix24 Input Neutralization on Invoice Edit Page. <br/>Chained with 2023-1716 | crm | 9 | BDU:2023-07463<br/>C | !YES| !NO Authenticated |
| 30.03.2023 | Cross-Site Scripting [XSS] The 1C-Bitrix / Bitrix24 Proacti flaw was missing a certain byte sequence <br/>that could be part of an XSS attack. <br/>Chained with C | security | 9 | BDU:2023-07462<br/>C | !YES| !NO |
| 30.03.2023 | Cross-Site Scripting [XSS] Prototype Pollution in <br/>bitrix/templates/bitrix24/components/bitrix/menu/left_/script.js | main | 9.6 | BDU:2023-07461<br/>C | !YES| !NO |
| 30.03.2023 | (Unauthenticated) [DOS] Denial of Service of 1C-Bitrix web project management system | main | 7.5 | BDU:2023-07460<br/>C | !YES| !NO DOS |
| 30.03.2023 | (Unauthenticated) Insecure direct object reference [IDOR] - Bitrix24 Insecure Global Extraction in bitrix/modules/main/tools.php | intranet | 7.5 | BDU:2023-07459<br/>C | !YES| !NO |
| 10.04.2023 | (Unauthenticated) Stored Cross-Site Scripting [XSS] a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile (Bitrix24 22.0.300) | main | 9.3 | BDU:2023-07458<br/>C | !YES| !NO |
| 30.03.2023 | (Authenticated) [RCE] Bitrix24 related to errors in the data import mechanism. <br/>Exploitation of this allows an internal attacker to increase his pri in the system. | main | 8.8 | BDU:2023-07457<br/>C | !YES| !NO Authenticated |
| 30.03.2023 | (Authenticated) [RCE] Bitrix24 related to an error in input data processing.<br/>Exploitation of this allows an internal attacker to execute<br/>arbitrary code on systems of certain configurations and php | crm | 8.8 | BDU:2023-07457<br/>C | !YES| !NO Authenticated |
| 13.09.2023 | [RCE] Site content management system (CMS) landing module | landing | 10 | BDU:2023-05857 | !YES| !NO |
| 28.10.2022 | Site content management system (CMS) | sale | 9.8 | BDU:2023-05566 | !YES| !NO |
| 24.10.2022 | Site content management system (CMS) | fileman | 9.6 | BDU:2023-05565 | !YES| !NO |
| 05.12.2019 | [RCE] in the embedded code editor of the website content management system (CMS) | main | 9.8 | BDU:2023-02793 | !YES| !NO |
| 28.10.2022 | (Authenticated) in the AD/LDAP server of Bitrix24 business management service<br/>that allows an intruder to gain unauthorized access to protected information. | ldap | 4.4 | BDU:2023-01604<br/>C | !YES| !NO Authenticated |
| 04.03.2022 | (Unauthenticated) [RCE] in the "vote" module of the website content management system (CMS) | vote | 9.8 | BDU:2022-01141<br/>C | | !YES | !YES |
| 12.10.2020 | Reflected Cross-Site Scripting [XSS] of arParams[API_KEY] parameter of map.google component of Bitrix24<br/>business management service allowing an attacker to execute arbitrary Ja code. | fileman | 9.8 | BDU:2021-03055 | !YES | !NO |
| | of 1C-Bitrix web project management system | main | 4.6 | BDU:2014-00404 | - | - |
| | of 1C-Bitrix web project management system | main | 10 | BDU:2014-00403 | - | - |

Project Architecture

Keeping data up to date manually can be time-consuming and error-prone.
To solve this, I built a simple re data pipeline that collects data from sources,
normalizes new records, and sends them for manual review before they are
approved and pushed to GitHub.

!bitrixprobe-pipeline

Project Structure

Each security assessment module, registered in the matching __init__.py file so the
runner can execute it.

项目信息

开发语言：Python

Star 数：23

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Open-source vulnerability assessment toolkit for 1C-Bitrix and Bitrix24 CMS audit, external pentest checks, and module/version analysis.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。