CVE-2024-11680ProjectSend Unauthenticated Configuration Modification
Explotación conocida — ProjectSend Improper Authentication Vulnerability
CISA confirmó el 03.12.2024 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 24.12.2024.
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 ; https://nvd.nist.gov/vuln/detail/CVE-2024-11680
Descripción
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| ProjectSend | ProjectSend | < r1720 |
Referencias y parches
- https://github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744 patchPatch
- https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf third-party-advisoryexploitMitigationTechnical Description
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb exploitExploit
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml exploitBroken LinkThird Party Advisory
- https://vulncheck.com/advisories/projectsend-bypass third-party-advisoryThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*< r1720