ProjectSend - Authentication Bypass (CVE-2024-11680)
Description
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
psychologyCrowdSec Analysis
CVE-2024-11680 is a critical vulnerability in ProjectSend that allows unauthenticated attackers to compromise application configuration through improper authentication controls. By sending specially crafted requests, threat actors can create new accounts, deploy webshells, or inject malicious JavaScript without prior access.
CrowdSec has been tracking this vulnerability and its exploits since 27th of November 2024.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-11680 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Observed exploitation efforts are aimed at direct requests to the /options.php URL.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-11-26 |
| Rule Released | 2024-11-27 |
| CrowdSec First Seen | 2024-11-29 |
| CISA KEV | 2024-12-03 |
| CISA Remediation Deadline | 2024-12-24 |
Remediation & Protection
External References
- https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
- https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb
- https://vulncheck.com/advisories/projectsend-bypass
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11680.yaml