Security Audit of 1C-Bitrix: Code, Server, Configuration
Once a client came to us: an online store on 1C-Bitrix that had lost its database. We restored it, but the cause remained unclear. The built-in security scanner found nothing. We conducted a manual audit and discovered infected PHP files in the upload folder — a vulnerability in a custom image upload component. The potential damage ranged from 200,000 to 5 million rubles, while the audit cost a fraction of that. Such cases are not uncommon.
Our experience: over 10 years working with the platform, more than 40 completed audits. Each report contains concrete remediation steps. You get not just a list of problems, but a protection roadmap.
Why Automated Scanners Are Not Enough
The built-in Bitrix scanner only checks known signatures. It misses obfuscated code, hidden backdoors, or business logic vulnerabilities — for example, SQL injection through a custom search component or XSS in a feedback form. Our approach combines automated checks with manual analysis. This allows us to detect up to three times more problems than any scanner. According to OWASP Top 10, injections and broken access control remain the most critical.
What We Check First
- Kernel and module versions — outdated cores contain known CVEs. Check changelogs for security patches. Critical updates are released out of schedule.
-
File and directory permissions — a typical problem on shared hosting:
PHP files infind /var/www/html -type f -name "*.php" -perm -o+w find /var/www/html/upload -type f -name "*.php"/upload/are a sure sign of infection or incorrect permissions. - Exposed directories —
/.git/,/bitrix/backup/,/bitrix/php_interface/should not be accessible from the outside. Check with curl.
How We Uncover Hidden Threats
We do not rely solely on the built-in scanner. Our process includes three stages:
Static Analysis of Custom Code
We search for dangerous functions (eval, base64_decode, system) and check output escaping. Over 20 parameters are verified.
Dynamic Testing
We attempt XSS, SQL injection, and CSRF attacks through personal accounts and feedback forms. The most vulnerable scenarios are tested.
Server Check
Port scanning, security headers, file permissions, and hidden directories are reviewed.
All results are compiled into a report with priorities: critical (fix immediately), high (fix within a week), medium, and low.
| Method | Coverage | Depth | Speed |
|---|---|---|---|
| Automated scanner | 30-40% of vulnerabilities | Shallow | Fast |
| Combined (our approach) | 90-95% of vulnerabilities | Contextual + business logic | 1-2 days |
A Case from Practice
We audited an online store after a suspected infection. The Bitrix scanner found nothing. A manual check with find /var/www -name "*.php" -newer /var/www/html/bitrix/modules/main/classes/general/module.php revealed 12 files with modified dates — in /upload/resize_cache/. All contained obfuscated PHP code with base64. The infection vector: a vulnerability in an outdated custom image upload component that did not check file extensions. We closed all critical vulnerabilities within two days.
Vulnerability Levels by CVSS
| Level | CVSS Score | Example | Remediation Time |
|---|---|---|---|
| Critical | 9.0–10.0 | Kernel vulnerability with RCE | A few hours |
| High | 7.0–8.9 | XSS in the public part | 1-2 days |
| Medium | 4.0–6.9 | Exposed directories | Up to a week |
| Low | 0.1–3.9 | Missing CSP header | Planned basis |
What You Get in the Report
Each report includes:
- Description of each vulnerability with code, screenshot, and reproduction steps.
- Classification by criticality (CVSS score).
- Specific technical remediation recommendations with code examples.
- Compliance check with 54-FZ (for online stores) and security standards.
- A personalized audit certificate with the company seal.
How Quickly Can Vulnerabilities Be Fixed?
We can perform the remediation ourselves — this is discussed separately. After fixing, we provide a follow-up check within a month. Order an audit and get protection that will save your business from millions in losses. Contact us for a consultation — we will select the optimal audit format.
Additionally, we analyze CommerceML exchange configurations, infoblock and HL-block settings, and check catalog caching. For online stores, verification of OFD integration and fiscalization (54-FZ) is mandatory.
Do not leave your site unprotected. Get a consultation right now.