CVE-2024-11680: ProjectSend Improper Authentication Vulnerability

CVE-2024-11680 is an improper authentication flaw in ProjectSend that lets a remote attacker with no credentials alter the application's configuration by sending crafted HTTP requests to options.php. Once configuration is changed, an attacker can create accounts, upload webshells, and inject malicious JavaScript, giving them a foothold on the server and potential access to shared files.

IT and security teams should treat this as a high-priority issue for any internet-facing or internal ProjectSend instance because successful abuse can lead directly to unauthorized access and code execution. Confirm all version and patch details against the vendor advisory before acting.

How it works

The vulnerability is classified as CWE-287 (Improper Authentication). ProjectSend fails to enforce proper authentication checks on the options.php endpoint. An unauthenticated remote attacker can therefore issue specially crafted HTTP requests that modify application settings without presenting valid credentials.

After the configuration is altered, the attacker can create new user accounts, upload web shells for persistent remote control, and embed malicious JavaScript that may execute in the browsers of legitimate users. No further authentication is required for these follow-on actions once the initial configuration change succeeds. Exact request formats and payloads are not detailed here; refer to the vendor advisory for technical confirmation.

Am I affected? How to find it in your systems

ProjectSend is typically deployed as a self-hosted web application for file sharing and collaboration, often running on Linux or Windows web servers with PHP and a database backend. It may appear on internal file-transfer portals, client extranets, or public-facing upload sites.

• Inventory web servers and application directories for ProjectSend installations; look for characteristic files such as options.php, the ProjectSend branding, or related configuration files.
• Check package managers, container images, and configuration-management inventories for any ProjectSend packages or Docker containers.
• Review web-server access logs for unauthenticated requests targeting options.php, especially those that result in configuration changes or unexpected account creation.
• Examine application logs and database records for newly created accounts, unexpected file uploads, or injected script content that cannot be attributed to legitimate administrators.
• Confirm the exact software version and configuration against the vendor advisory, because public detail on affected releases is limited to the product name ProjectSend.

How to remediate

Apply the vendor-supplied update or mitigation instructions for ProjectSend as the primary remediation step. CISA directs organizations to follow the vendor guidance or discontinue use of the product if mitigations are unavailable.

• Obtain and install the official patch or configuration fix from the ProjectSend vendor; verify the update removes the improper authentication check on options.php.
• After patching, reset any administrative credentials, review and remove unauthorized accounts, and scan the web root for webshells or unexpected JavaScript.
• Harden the application by enforcing strong authentication for all administrative endpoints, restricting write access to configuration files, and ensuring the web server process runs with least privilege.
• Enable and retain detailed logging of configuration changes and account-management events so future anomalies can be detected quickly.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls that limit who can reach the vulnerable endpoint and what an attacker can achieve.

• Segment the ProjectSend host so that options.php is reachable only from trusted management networks or VPN ranges; block direct internet access if the service does not require it.
• Deploy a web application firewall or reverse-proxy rule that challenges or drops unauthenticated requests to options.php and other administrative paths.
• Temporarily disable or rename the options.php endpoint if operational requirements allow, or place the entire application behind multi-factor authentication.
• Increase monitoring for new account creation, file uploads, and JavaScript injection; alert on any configuration-file modifications.
• If mitigations cannot be implemented, plan to take the instance offline until a permanent fix is available, consistent with CISA guidance.

If your data may have been exposed

Actively exploited vulnerabilities of this class frequently lead to account takeover, webshell deployment, and data theft. If logs or other indicators suggest compromise, treat the incident as a potential breach: isolate the host, preserve forensic evidence, rotate credentials, and notify affected parties according to your incident-response plan. You can also run a free exposure scan of your email addresses to check whether they appear in known breach data sets.