Critical Flaw in ProjectSend Under Active Exploitation Against Public
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-11680 | Unauthenticated Config Tampering and Webshell Upload in ProjectSend (pre-r1720) ProjectSend versions prior to r1720 fail to enforce authentication on requests to options.php (CWE-306, missing authentication for a critical function), a critical flaw rated CVSS 9.8. A remote, unauthenticated attacker can send crafted HTTP requests directly to options.php to modify the application's configuration without any user interaction. With configuration control, the attacker can enable registration and create accounts, upload webshells to achieve code execution on the server, and embed malicious JavaScript in the site. Any organization running ProjectSend earlier than r1720 — especially internet-facing deployments used for client file exchange — is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-12-03, carries a 91.7% EPSS probability of exploitation within 30 days, and public reporting and a Metasploit module are available. Do: Upgrade ProjectSend to r1720 or later, which restores proper authentication on options.php; per CISA's KEV required action, apply vendor mitigations or discontinue use of the product if mitigation is not possible. Prioritize internet-facing instances and hunt for signs of compromise, including unexpected or new user accounts, modified configuration, unexpected PHP files or webshells on the server, and injected JavaScript. Until patched, restrict network access to the installation and limit or protect access to options.php. | 9.8 | 92% | KEV PoC |
| moderateroughly 1,000–10,000 internet-exposed ProjectSend instances (self-hosted app; no central install count) |
Full article382 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananNov 27, 2024Vulnerability / Software Security
A critical security flaw impacting the ProjectSend open-source file-sharing application has likely come under active exploitation in the wild, according to findings from VulnCheck.
The vulnerability, originally patched over a year-and-a-half ago as part of a commit pushed in May 2023, was not officially made available until August 2024 with the release of version r1720. As of November 26, 2024, it has been assigned the CVE identifier CVE-2024-11680 (CVSS score: 9.8).
Synacktiv, which reported the flaw to the project maintainers in January 2023, described it as an improper authorization check that allows an attacker to execute malicious code on susceptible servers.
"An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files," it said in a report published in July 2024.
"Ultimately, this allows to execute arbitrary PHP code on the server hosting the application."
VulnCheck said it observed unknown threat actors targeting public-facing ProjectSend servers by leveraging exploit code released by Project Discovery and Rapid7. The exploitation attempts are believed to have commenced in September 2024.
The attacks have also been found to enable the user registration feature to gain post-authentication privileges for follow-on exploitation, indicating that they are not confined to scanning for vulnerable instances.
"We are likely in the 'attackers installing web shells' territory (technically, the vulnerability also allows the attacker to embed malicious JavaScript, too, which could be an interesting and different attack scenario)," VulnCheck's Jacob Baines said.
"If an attacker has uploaded a web shell, it can be found in a predictable location in upload/files/ off of the webroot."
An analysis of about 4,000 internet-exposed ProjectSend servers has revealed that a mere 1% of them are using the patched version (r1750), with all the remaining instances running either an unnamed release or version r1605, which came out in October 2022.
In light of what appears to be widespread exploitation, users are recommended to apply the latest patches as soon as possible to mitigate the active threat.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/11/critical-flaw-in-projectsend-under.html