ProjectSend Unauthenticated Configuration Modification (CVE-2024-11680)

What is affected, what to do

An unauthenticated attacker can exploit an improper authentication vulnerability in ProjectSend versions prior to r1720 to gain full control of the application. By sending crafted HTTP requests to options.php, attackers can modify the application's configuration, create accounts, upload webshells, and embed malicious JavaScript. This vulnerability is actively exploited in the wild. All versions of ProjectSend before r1720 are affected. It is imperative to update to version r1720 or later to mitigate this risk.

The vulnerability is being actively exploited; treat it as a priority. Update ProjectSend to version r1720. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• ProjectSend lt *..r1720

Fixed in

• ProjectSend r1720

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every ProjectSend instance, including shadow IT run by business units or vendors. Use the asset inventory, web server vhosts, or search for the ProjectSend login page and options.php. Check the installed revision. Anything before r1720 is vulnerable.
   • Patch: Upgrade to ProjectSend r1720 or later. If you cannot do this within hours, pull the instance off the internet (reverse-proxy deny, firewall block on 80/443) or restrict access to known partner IP ranges.
   • Hunt for compromise before patching: Patching does not remove an implanted webshell. Snapshot and review the following before and after the upgrade:
     • tbl_options: unexpectedly enabled client self-registration or auto-approval, allowed file extensions widened to php, phtml or phar, a changed site title, or injected JavaScript.
     • tbl_users: recently created accounts.
   • Webshell sweep: Search upload/files/ and upload/temp/ for executable files (*.php*, *.phtml, *.phar) and look for recently modified files anywhere in the webroot.
   • If you find anything, switch to incident mode:
     • Isolate the host and preserve evidence (disk, web logs, DB dump).
     • Reset all ProjectSend admin and client passwords.
     • Rotate the database credentials in includes/sys.config.php and the SMTP credentials.
     • Scope which shared files may have been exfiltrated. This drives your GDPR and NIS2 notification decisions.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Do not expose ProjectSend directly. Front it with a reverse proxy that enforces pre-authentication (SSO/IdP, mTLS or VPN). Restrict outbound traffic from the web host to what is required (SMTP, updates) to hamper reverse shells and second-stage downloads.
   • WAF/reverse-proxy rule:
     • Allow /options.php only from the admin management network, e.g. nginx location = /options.php { allow 10.0.10.0/24; deny all; }.
     • Also block POSTs to options.php that lack a previously issued, valid session cookie.
   • Web server hardening: Disable PHP execution in the upload directory.
     • nginx: location ^~ /upload/ { location ~ \.ph(p|tml|ar)$ { deny all; } }
     • Apache: php_admin_flag engine off or <FilesMatch "\.ph">Require all denied</FilesMatch>
     • Ideally, move uploads outside the webroot.
   • Application configuration:
     • Disable client self-registration and auto-approval.
     • Restrict allowed file types to an allowlist without script formats.
     • Scope the ProjectSend DB account to its own schema.
   • Integrity monitoring: Run FIM (Wazuh/OSSEC, AIDE) on the webroot and upload directory. Add a scheduled diff of tbl_options against an approved baseline (hash of option values).
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: POSTs to /options.php from source IPs with no prior successful login (POST /index.php returning 302 to the dashboard). The typical chain is GET options.php (CSRF token harvest) → POST options.php → registration → upload. SPL sketch: index=web uri_path="/options.php" method=POST | stats count by src_ip | join type=left src_ip [search index=web uri_path="/index.php" method=POST status=302]
   • Requests to executable uploads: Requests under /upload/ ending in .php, .phtml or .phar, especially with parameters such as cmd= or c=. Sigma shape: cs-uri-stem|contains: '/upload/' AND cs-uri-stem|endswith: ['.php','.phtml','.phar'].
   • EDR/Sysmon process ancestry: A web server or PHP process (apache2, httpd, php-fpm, nginx, w3wp.exe, php-cgi.exe) spawning shells or recon tools (sh, bash, cmd.exe, powershell.exe, whoami, id, uname, curl, wget). Sources: Sysmon EID 1 (ParentImage) or auditd execve events whose parent is the web server user.
   • File creation: New script files under upload/ written by the web server user, visible in Sysmon EID 11 or via an auditd watch (-w /var/www/projectsend/upload -p wa -k ps_upload).
   • Application and DB layer:
     • New rows in tbl_users outside change windows.
     • Modifications to tbl_options (registration, file types, site title).
     • <script> fragments in option values.
     • Review via tbl_actions_log or the MySQL general/audit log.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling unauthorized modification of the application's configuration. Successful exploitation allows attackers to create accounts, upload webshells, and embed malicious JavaScript.

Source: pwn.watch, cvelistv5, CISA KEV Catalog, NVD (NIST), CVE.org (MITRE)

Vendors and products

• ProjectSend ProjectSend

Weakness classes (CWE)

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

References & sources

• github.comProjectSend advisory: CVE-2024-11680Patch, pwn-watch
• synacktiv.comsites/default/files/2024-07/synacktiv-projectsend-multiple-vuln…Third-party advisory, Exploit
• github.comrapid7/metasploit-framework/blob/master/modules/exploits/linux/…Exploit
• github.comprojectdiscovery/nuclei-templates/blob/main/http/vulnerabilitie…Exploit
• vulncheck.comadvisories/projectsend-bypassThird-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-11680government-resource
• pwn.watchpwn.watch: ProjectSend Improper Authenticationpwn-watch
• NVD (NIST)NVD: CVE-2024-11680pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch