DIVD-2024-00051 - Improper authorization vulnerabilty in ProjectSend,

Summary

A critical vulnerability in ProjectSend, a widely-used open-source file-sharing platform, has been actively exploited. The vulnerability, found in versions prior to r1720, enables unauthenticated attackers to modify application configurations via improperly authorised requests. This allows exploitation scenarios such as enabling unauthorised user registration, uploading PHP webshells, or embedding malicious JavaScript, leading to server compromise.

Recommendations

To remediate CVE-2024-11680, upgrade ProjectSend to version r1720 or later to resolve the improper authorisation vulnerability. Limit public access by applying strict network controls and review server logs for unusual activity, especially targeting options.php or unauthorised uploads in upload/files/. For any compromised systems, remove malicious files, restore original configurations, and investigate further for signs of exploitation. Establish a patch management process to ensure timely updates and minimise exposure to future vulnerabilities

What we are doing

DIVD is currently working to identify parties that are running a vulnerable version of ProjectSend and to notify these parties.

Timeline

More information

• CVE-2024-11680
• VulnCheck Blog: CVE-2024-10914 Exploited in the Wild
• Cencys advisory CVE-2024-10914