CRITICAL

CVE-2024-11680

Projectsend Projectsend 2024-11-26 CVSS v3.1

CVSS

9.8

KEV

Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Summary dbcve.org

ProjectSend versions prior to r1720 contain an improper authentication vulnerability in options.php that allows remote, unauthenticated attackers to send crafted HTTP requests and modify application configuration. This enables account creation, webshell upload, and malicious JavaScript injection.

Mitigation

Upgrade to ProjectSend r1720 or later to patch the authentication bypass. If immediate upgrade is not feasible, implement network-level access controls to restrict access to options.php from untrusted sources.

Proof of Concept

Patch Commit

Weakness (CWE)

CWE-306 Missing Authentication

EPSS Score

91.7%

Probability of exploitation in next 30 days

99.8th percentile

References

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml Broken Link, Third Party Advisory https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 Patch https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb Exploit https://vulncheck.com/advisories/projectsend-bypass Third Party Advisory https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf Mitigation, Technical Description, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE