Overview
As part of our regular security review process, several potential security issues were identified in the CleanTalk Anti-Spam module for 1C-Bitrix.
The reported issues included:
- Cross-Site Scripting (XSS);
- Cross-Site Request Forgery (CSRF);
- Server-Side Request Forgery (SSRF);
- Information Disclosure;
- SQL Injection related code hardening issues;
- Additional low-risk defense-in-depth findings.
All reported issues were reviewed by our development and security teams. Confirmed vulnerabilities have been fixed in the latest module release. Several findings were additionally determined to be non-exploitable in real-world conditions.
Security Issues Addressed
During the security review, researchers identified several issues related to input validation, output encoding, administrative interface protections, request handling, and secure communication with external services.
The reported findings included potential scenarios involving cross-site scripting (XSS), request forgery protections, server-side request validation, database query hardening, and transport layer security configuration. Additional defense-in-depth improvements were also implemented to further strengthen the security of the module.
All confirmed issues were addressed in the latest release, while several findings were determined to be non-exploitable after manual review.
Affected Versions
Customers using outdated versions of the CleanTalk Anti-Spam module for 1C-Bitrix are strongly encouraged to update to the latest available version.
Solution
The necessary security fixes have been included in the current release of the CleanTalk Anti-Spam module.
To receive all security improvements, please update the module to the latest version.
Update Instructions
Please follow the official update guide:
https://cleantalk.org/help/update-bitrix
The guide contains step-by-step instructions for updating the module manually.
Recommendations
We recommend that all customers:
- Update the module to the latest version as soon as possible;
- Verify that the update has been completed successfully;
- Regularly install new module releases to receive security and stability improvements.
Contact
If you have any questions regarding this security update, please contact the CleanTalk support team.