ProjectSend up to r1719 HTTP Request options.php improper authentication

Summaryinfo

A vulnerability categorized as critical has been discovered in ProjectSend up to r1719. This affects an unknown part of the file options.php of the component HTTP Request Handler. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2024-11680. The attack can be launched remotely. Moreover, an exploit is present. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in ProjectSend up to r1719. Affected by this issue is an unknown functionality of the file options.php of the component HTTP Request Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-11680 since 11/25/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a exploit are known. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/22/2025).

It is declared as attacked. By approaching the search of inurl:options.php it is possible to find vulnerable targets with Google Hacking. The vulnerability scanner Nessus provides a plugin with the ID 271956 (ProjectSend < r1720 Authentication Bypass (CVE-2024-11680)), which helps to determine the existence of the flaw in a target environment. This issue was added on 12/03/2024 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 12/24/2024:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading to version r1720 eliminates this vulnerability. Applying the patch 193367d937b1a59ed5b68dd4e60bd53317473744 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (271956) and EUVD (EUVD-2024-34152). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Project Management Software

Name

• ProjectSend

Version

• r1719

License

• open-source

Website

• Product: https://github.com/projectsend/projectsend/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion