ProjectSend is a free, open source software that lets you share files with your clients, focused on ease of use and privacy. It supports clients groups, system users roles, statistics, multiple lan...

Critical vulnerability in ProjectSend (CVE-2024-11680) actively exploited. Learn how to protect your instance from unauthorized access and potential abuse.

Proof of Concept (PoC) Exploit for CVE-2024-11680, Critical Vulnerability in ProjectSend

Researchers warn that a critical security flaw in ProjectSend open-source file-sharing application may be under active exploitation.

VulnCheck warns of widespread exploitation of a year-and-a-half-old ProjectSend vulnerability for which multiple public exploits exist.

This vulnerability was patched in May 2024 but was only allocated a CVE in November after evidence of exploitation

Critical ProjectSend flaw (CVE-2024-11680) actively exploited. Update to version r1750 to secure your server.

The Cybersecurity and Infrastructure Security Agency Warns of CyberPanel, North Grid, ProjectSend & Zyxel firewalls flaws exploited in wild.

Threat actors are using public exploits for a critical authentication bypass flaw in ProjectSend to upload webshells and gain remote access to servers. [...]

Auch wenn ein Sicherheitspatch für ProjectSend schon länger als ein Jahr verfügbar ist, sind offensichtlich noch unzählige Instanzen verwundbar.

Threat actors are using public exploits for a critical authentication bypass flaw in ProjectSend to upload webshells and gain remote access to servers.

VulnCheck discovers evidence that ProjectSend has been exploited in the wild and assigns CVE-2024-11680

Hackers are actively exploiting a critical authentication vulnerability in ProjectSend, a popular open-source file-sharing web application. The vulnerability, now identified as CVE-2024-11680, allows remote, unauthenticated attackers to bypass authentication and modify the application’s configuration, potentially leading to unauthorized account creation, webshell uploads, and malicious JavaScript injection. Despite the patch being available since May 16, 2023, the CVE was only assigned on November 26, 2024, leaving many systems exposed for over a year. The delay in CVE assignment is particularly notable given that Rapid7, a CVE Numbering Authority, had already published a Metasploit module for this vulnerability. Security researchers at VulnCheck have observed clear signs of exploitation in the wild. Public-facing ProjectSend servers have been found with altered landing page titles, consistent with the behavior of both Nuclei and Metasploit exploit tools. Technical Analysis These tools modify the victim’s configuration file to change the site name, resulting in long, random-like strings appearing in HTTP titles. More alarmingly, attackers are not limiting themselves to mere vulnerability testing. VulnCheck has noted widespread enabling of user registration settings, a non-default configuration that allows attackers to gain post-authentication privileges. This suggests that malicious actors are likely moving beyond testing and potentially installing webshells or embedding malicious JavaScript. The vulnerability’s impact is exacerbated by poor patch adoption rates. VulnCheck’s analysis of internet-facing ProjectSend instances revealed that only 1% are running the patched version (r1750). A staggering 55% are still using the vulnerable r1605 version released in October 2022, while 44% are on an unnamed release from April 2023. Patch Adoption Graph (Source – VulnCheck) Given the timeline of events, available exploits, and low patch adoption, security experts believe that exploitation is likely widespread and could increase significantly in the near future. Vulnerability Timeline (Source – VulnCheck) The vulnerability allows attackers to send crafted HTTP requests to options.php, enabling unauthorized modification of the application’s configuration. Organizations using ProjectSend are strongly advised to immediately upgrade to version r1720 or later to mitigate this critical security risk . Additionally, security teams should assess their exposure, implement necessary remediations, and conduct thorough incident response activities to detect any potential compromises. This incident underscores the importance of prompt patching and the need for better coordination in vulnerability disclosure and CVE assignment processes. As the threat landscape continues to evolve, staying vigilant and maintaining up-to-date security measures remains crucial for organizations of all sizes. The post Hackers Exploiting ProjectSend Authentication Vulnerability In The Wild appeared first on Cyber Security News .