This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: ProjectSend r1720- has an **Improper Authentication** flaw. Attackers bypass login to modify configs. π₯ **Consequences**: Full system compromise, arbitrary PHP code execution, and total data loss.
Q2Root Cause? (CWE/Flaw)
π‘οΈ **Root Cause**: **CWE-306** (Improper Authentication) & **CWE-287**. The app fails to verify identity for sensitive actions like `options.php`. π **Flaw**: Missing access control checks allow unauthenticated writes.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: **ProjectSend** versions **prior to r1720** (e.g., r1605 and older). π **Component**: The core PHP application logic handling configuration and user management.
Q4What can hackers do? (Privileges/Data)
π **Privileges**: Attackers gain **Admin-level** access without credentials. π **Data**: Can create accounts, enable file uploads, modify whitelists, and execute **Arbitrary PHP Code** on the server.
Q5Is exploitation threshold high? (Auth/Config)
π **Threshold**: **LOW**. No authentication required (PR:N). Low complexity (AC:L). No user interaction needed (UI:N). π― **Config**: Exploits via crafted HTTP requests to `options.php`.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Exploit**: **Yes, Public**. PoCs exist on GitHub (e.g., `famixcm`, `D3N14LD15K`). Metasploit module available. π **Wild Exploitation**: High risk due to ease of use and critical impact.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for ProjectSend instances. Check version number (< r1720). Use Nuclei templates (`CVE-2024-11680.yaml`). π§ͺ **Test**: Attempt unauthenticated POST to `options.php` (Do not exploit in prod!).
Q8Is it fixed officially? (Patch/Mitigation)
β **Fixed**: **Yes**. Patch available in **ProjectSend r1720**. π **Commit**: `193367d937b1a59ed5b68dd4e60bd53317473744`. Upgrade immediately to the latest version.
Q9What if no patch? (Workaround)
π§ **Workaround**: If patching is delayed, **restrict access** to `options.php` via WAF or firewall rules. Disable file upload features if possible. Monitor logs for unauthorized config changes.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **CRITICAL (9.8 CVSS)**. Immediate action required. Remote Code Execution (RCE) is possible. π **Priority**: Patch to r1720+ **NOW** to prevent server takeover.