CVE-2024-11680

🗓️ 26 Nov 2024 09:55:23Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 350 Views🌐 WEB

ProjectSend versions prior to r1720 have improper authentication allowing remote, unauthenticated attackers to modify application configuration and perform unauthorized actions

Reporter	Title	Published	Views	Family All 25
GithubExploit	Exploit for Missing Authentication for Critical Function in Projectsend	31 Mar 202612:10	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Projectsend	4 Dec 202418:42	–	githubexploit
ATTACKERKB	CVE-2024-11680	26 Nov 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the ProjectSend file-sharing software is related to deficiencies in the authentication process, which allows attackers to modify the application’s configuration.	29 Nov 202400:00	–	bdu_fstec
Circl	CVE-2024-11680	21 Nov 202417:59	–	circl
CISA KEV Catalog	ProjectSend Improper Authentication Vulnerability	3 Dec 202400:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	3 Dec 202412:00	–	cisa
CNNVD	ProjectSend 安全漏洞	26 Nov 202400:00	–	cnnvd
Cvelist	CVE-2024-11680 ProjectSend Unauthenticated Configuration Modification	26 Nov 202409:55	–	cvelist
Kitploit	CVE-2024-11680_PoC_Exploit	31 Aug 202615:24	–	kitploit

NVD

Vulners

Vulnrichment

CNA

Node

projectsend projectsendRange<r1720

[
  {
    "defaultStatus": "unaffected",
    "packageURL": "pkg:github/projectsend/projectsend",
    "product": "ProjectSend",
    "programFiles": [
      "options.php"
    ],
    "repo": "https://github.com/projectsend/projectsend",
    "vendor": "ProjectSend",
    "versions": [
      {
        "lessThan": "r1720",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
synacktiv	www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf
vulncheck	www.vulncheck.com/advisories/projectsend-bypass
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/projectsend_unauth_rce.rb
github	www.github.com/projectsend/projectsend/commit/193367d937b1a59ed5b68dd4e60bd53317473744
github	www.github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/projectsend-auth-bypass.yaml
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
csrf_token	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
section	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
clients_can_register	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
clients_auto_approve	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
clients_can_upload	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
clients_can_delete_own_files	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
clients_auto_group	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
clients_can_select_group	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
expired_files_hide	request body	options.php	Modify settings to enable unauthenticated actions (registration, upload, deletion) via options.php	CWE-306
name	request body	includes/upload.process.php	Upload a PHP payload through the includes/upload.process.php endpoint	CWE-306