CVE-2024-11680
ProjectSend Improper Authentication Vulnerability
Description
CVE-2024-11680 is a critical improper authentication vulnerability in ProjectSend, an open-source file sharing application, affecting all versions prior to r1720. The flaw allows remote, unauthenticated attackers to modify the application's configuration by sending crafted HTTP requests to the options.php endpoint, enabling unauthorized account creation, webshell uploads, and malicious JavaScript injection. With a CVSS v3.1 base score of 9.8 and a network-accessible attack vector requiring no privileges or user interaction, this vulnerability provides attackers with complete control over the ProjectSend instance. CISA has added CVE-2024-11680 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 24, 2024, and its EPSS score of 93.49% at the 99.8th percentile indicates near-certain exploitation of internet-facing instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| projectsend | projectsend | < r1720 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml(Broken Link, Third Party Advisory)
- https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744(Patch)
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb(Exploit)
- https://vulncheck.com/advisories/projectsend-bypass(Third Party Advisory)
- https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf(Mitigation, Technical Description, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2024-11680 is classified under CWE-287 (Improper Authentication), a critical weakness where an application fails to prove that a user has the identity they claim or does not enforce authentication for security-critical operations. In ProjectSend, the options.php endpoint — which controls the application's core configuration — does not properly verify that incoming requests originate from an authenticated administrator. This allows unauthenticated attackers to send crafted HTTP requests that modify security-critical settings such as user registration permissions, file upload restrictions, and embedded scripts, effectively granting the attacker full administrative control without ever providing valid credentials.
CWE-434: Unrestricted Upload of File with Dangerous Type
The vulnerability chain also involves CWE-434 (Unrestricted Upload of File with Dangerous Type). Once the attacker has modified the application configuration through the authentication bypass, they can enable unrestricted file uploads and then upload webshells or other malicious executable files to the server, converting the configuration manipulation into full remote code execution.
Impact Analysis
The impact of CVE-2024-11680 is severe across all CIA dimensions. Confidentiality is fully compromised because the authentication bypass grants access to all application configuration data, and the ability to create administrative accounts provides unrestricted access to all files shared through ProjectSend. Organizations using ProjectSend for sensitive file transfers expose all stored documents, user credentials, and metadata to the attacker.
Integrity faces maximum impact through multiple attack vectors. The configuration manipulation allows attackers to embed malicious JavaScript that executes in the browsers of legitimate users visiting the application, enabling credential theft and further compromise. Webshell uploads grant persistent server-side code execution, allowing modification of any file on the server. The ability to create new user accounts and modify existing settings means the attacker can fundamentally alter how the application operates.
Availability is fully threatened as remote code execution via uploaded webshells enables attackers to shut down the application, corrupt data, deploy ransomware, or use the server as a pivot point for attacking other internal systems. The attack is trivially exploitable — requiring only crafted HTTP requests with no authentication, no user interaction, and low complexity. A working Metasploit module is publicly available, and Nuclei templates enable automated detection.
Exploit Maturity
CVE-2024-11680 has reached very high exploit maturity with confirmed active exploitation. CISA has added it to the Known Exploited Vulnerabilities catalog, and the EPSS score of 93.49% at the 99.8th percentile confirms that this is among the most likely vulnerabilities to be exploited.
Multiple public exploitation tools are available. A Metasploit module provides automated exploitation from initial authentication bypass through to remote code execution. Nuclei templates enable mass scanning for vulnerable instances. A detailed technical analysis by Synacktiv documents the full vulnerability chain, and VulnCheck provides an independent advisory. The patch commit is publicly available in the ProjectSend repository. While CISA has not confirmed a direct ransomware association, the availability of automated exploitation tools and the ease of achieving remote code execution make this vulnerability an attractive target for all types of threat actors.
Remediation
-
Update ProjectSend to version r1720 or later immediately. The fix is available in the ProjectSend repository. Download the latest release and follow the standard upgrade procedure to replace the vulnerable installation.
-
Restrict network access to the ProjectSend instance as an immediate compensating control. If the application must remain accessible from the internet, place it behind a web application firewall (WAF) that can block unauthorized requests to the options.php endpoint. If possible, restrict access to trusted IP ranges or require VPN access.
-
Audit the application for signs of compromise. Check for unauthorized user accounts that may have been created through the vulnerability. Review the application configuration for unexpected changes, particularly to user registration settings, upload permissions, and embedded scripts. Search the upload directories for webshells or suspicious files with executable extensions.
-
Review server integrity beyond the ProjectSend application. If webshells were uploaded, the attacker may have gained full server access. Check for unauthorized SSH keys, modified system files, new cron jobs, and unexpected network connections. Examine web server access logs for requests to options.php from unknown sources.
-
Reset all credentials associated with the ProjectSend instance, including administrator and user passwords, database credentials, and any API keys or integration tokens configured in the application.
Technical Details
CVE-2024-11680 is an improper authentication vulnerability in ProjectSend, an open-source file sharing web application. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting a network-accessible attack with no prerequisites and maximum impact across all CIA dimensions.
The vulnerability exists in the options.php endpoint of ProjectSend versions prior to r1720. This endpoint is responsible for managing the application's configuration settings, including user registration policies, file upload restrictions, and embedded content. The endpoint fails to verify that incoming HTTP requests are from authenticated administrators, accepting and processing configuration changes from any unauthenticated request.
The exploitation chain typically proceeds in three stages. First, the attacker sends crafted HTTP requests to options.php to enable user self-registration and modify upload restrictions. Second, the attacker creates a new user account with the modified registration settings and uploads a PHP webshell through the now-unrestricted upload functionality. Third, the attacker accesses the uploaded webshell to execute arbitrary commands on the server.
Additionally, the attacker can inject malicious JavaScript into the application's configuration that executes in the browsers of all visitors, enabling cross-site scripting attacks against legitimate users. This provides an alternative attack path for credential harvesting without requiring file upload.
The scope is unchanged (S:U) as the vulnerability operates within ProjectSend's application context, but achieving remote code execution on the server extends the practical impact well beyond the application itself, especially in environments where ProjectSend runs alongside other applications on a shared server.
Frequently Asked Questions
What is CVE-2024-11680?
CVE-2024-11680 is a critical authentication bypass vulnerability in ProjectSend, an open-source file sharing application. It allows unauthenticated attackers to modify the application's configuration, create accounts, upload webshells, and inject malicious JavaScript by sending crafted requests to the options.php endpoint.
How is CVE-2024-11680 exploited in practice?
Attackers send unauthenticated HTTP requests to the options.php endpoint to modify ProjectSend's configuration. This enables user self-registration and unrestricted file uploads. The attacker then creates an account and uploads a webshell to gain remote code execution on the server.
Is there a public exploit available for CVE-2024-11680?
Yes. Multiple public exploits exist, including a Metasploit module that automates the full exploitation chain from authentication bypass to remote code execution. Nuclei templates are also available for automated vulnerability scanning.
What ProjectSend versions are affected?
All ProjectSend versions prior to r1720 are vulnerable. Organizations should update to r1720 or later immediately. The vulnerability was introduced early in the application's development, meaning most deployed instances are likely affected.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.