# CVE-2024-11680: ProjectSend - Authentication Bypass

> Live exploitation tracking for CVE-2024-11680 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-11680

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** ProjectSend
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** enterprise_software

## Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

## CrowdSec analysis

[CVE-2024-11680](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-11680) is a critical vulnerability in ProjectSend that allows unauthenticated attackers to compromise application configuration through improper authentication controls. By sending specially crafted requests, threat actors can create new accounts, deploy webshells, or inject malicious JavaScript without prior access.

CrowdSec has been tracking this vulnerability and its exploits since 27th of November 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-11680 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation efforts are aimed at direct requests to the `/options.php` URL.

## Timeline

- 2024-11-26: CVE Published. CVE-2024-11680 is published to NVD.
- 2024-11-27: Rule Released. CrowdSec releases a rule to detect CVE-2024-11680 exploitation attempts against the CrowdSec Network.
- 2024-11-29: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-11680 for the first time.
- 2024-12-03: CISA KEV. CVE-2024-11680 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-12-24: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
- https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb
- https://vulncheck.com/advisories/projectsend-bypass
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-11680.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-11680) follows observed exploitation activity for CVE-2024-11680. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.