CVEs / CVE-2024-11680
CVE-2024-11680: ProjectSend Improper Authentication Vulnerability
- Known exploited in the CISA KEV catalog since 3 Dec 2024
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 91.8% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2024-11680
Summary
ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
Description
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| ProjectSend ProjectSend | before r1720 | r1720 |
| projectsend projectsend | before r1720 | r1720 |
Exploitation
| In CISA KEV since | 3 Dec 2024 |
|---|---|
| Due date for US federal agencies | 24 Dec 2024 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-306 |
References
- CVE-2024-11680 on NVD
- CVE-2024-11680 in the CISA KEV catalog
- https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 (cited by CISA)
- CVE-2024-11680 on OSV
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml Broken Link, Third Party Advisory
- https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 Patch
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb Exploit
- https://vulncheck.com/advisories/projectsend-bypass Third Party Advisory
- https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf Mitigation, Technical Description, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.