ProjectSend Improper Authentication Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-12-03
• EPSS: 92% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

CISA: ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application's configuration via crafted HTTP requests to options.php. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Dec 2024): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• Patch on github.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend…Broken LinkThird Party Advisory
• github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744Patch
• github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projects…Exploit
• vulncheck.com/advisories/projectsend-bypassThird Party Advisory
• www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabil…MitigationTechnical DescriptionThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource