Malicious Actors Exploit ProjectSend Critical Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-11680 | Unauthenticated Config Tampering and Webshell Upload in ProjectSend (pre-r1720) ProjectSend versions prior to r1720 fail to enforce authentication on requests to options.php (CWE-306, missing authentication for a critical function), a critical flaw rated CVSS 9.8. A remote, unauthenticated attacker can send crafted HTTP requests directly to options.php to modify the application's configuration without any user interaction. With configuration control, the attacker can enable registration and create accounts, upload webshells to achieve code execution on the server, and embed malicious JavaScript in the site. Any organization running ProjectSend earlier than r1720 — especially internet-facing deployments used for client file exchange — is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-03, carries a 91.7% EPSS probability of exploitation within 30 days, and public reporting and a Metasploit module are available. Do: Upgrade ProjectSend to r1720 or later, which restores proper authentication on options.php; per CISA's KEV required action, apply vendor mitigations or discontinue use of the product if mitigation is not possible. Prioritize internet-facing instances and hunt for signs of compromise, including unexpected or new user accounts, modified configuration, unexpected PHP files or webshells on the server, and injected JavaScript. Until patched, restrict network access to the installation and limit or protect access to options.php. | 9.8 | 92% | KEV PoC |
| moderateroughly 1,000–10,000 internet-exposed ProjectSend instances (self-hosted app; no central install count) |
Full article316 words · extracted from infosecurity-magazine.com · click to collapse
Public-facing instances of ProjectSend, an open-source file-sharing web application, have been exploited by attackers, according to vulnerability intelligence provider VulnCheck.
ProjectSend was created by software developer Ignacio Nelson and is maintained by a group of over 50 people. It has received support from 1500 people on GitHub.
The web application has been affected by an improper authentication vulnerability since at least January 2024, when cybersecurity firm Synactiv reported it to the project maintainers.
Exploiting this vulnerability allows attackers to enable unauthorized modification of the application's configuration by remotely sending crafted HTTP requests to options.php. This can enable them to create accounts, upload webshells and embed malicious JavaScript.
The flaw was patched in May and ProjectSend released an official patch version in August.
However, no CVE was allocated to the vulnerability, meaning that users did not know how critical it was.
Since the patch release, multiple exploits have been published by Synactiv, Project Discovery (using Nuclei), and Rapid7 (using Metasploit).
In November, VulnCheck noticed that many public-facing ProjectSend instance servers had started changing their landing page titles to long, suspicious-looking strings.
Upon investigating where this abnormal behavior came from, VulnCheck concluded that attackers actively intended to exploit the vulnerability.
VulnCheck, a CVE numbering authority, allocated a CVE number to the vulnerability, CVE-2024-11680.
It also assigned a CVSS score of 9.8, meaning the vulnerability is highly critical.
The VulnCheck Initial Access team developed a scanner to fingerprint the versions of ProjectSend internet-facing systems. It found that only 1% of users were using the patched version (r1750).
“Given the timeline, evidence of exploitation and lack of patch adoption, we assume that exploitation is likely widespread. And if not now, then in the near future considering the abysmal patching rates,” the VulnCheck researchers added in a blog post.
Read now: Navigating the Vulnerability Maze – Understanding CVE, CWE, and CVSS
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/exploit-projectsend-critical/