Hackers are exploiting a critical authentication vulnerability in ProjectSend, a popular open-source file-sharing application.
The vulnerability, known as CVE-2024-11680, allows unauthenticated remote hackers to bypass authentication and modify application settings, potentially leading to unauthorized account creation, webshell injection, and malicious JavaScript.
See also: NVIDIA UFM vulnerability allows hackers to escalate privileges
Although the patch has been available since May 16, 2023, the CVE code was only assigned on November 26, 2024, leaving many systems exposed for over a year. The delay in the CVE assignment is notable, given that Rapid7, a CVE Numbering Authority, had already released a Metasploit module for this vulnerability.
VulnCheck security researchers have observed clear signs of exploitation in real-world conditions. Public ProjectSend servers have been found with altered homepage titles, behavior consistent with exploitation via tools such as Nuclei and Metasploit.
Technical analysis shows that these tools modify the victim's configuration file by changing the name of the website, causing random strings to appear in HTTP headers. Even more worryingly, hackers are not limited to testing the vulnerability. VulnCheck observed the user registration settings being enabled, a non-default setting that allows hackers to gain privileges after authentication, suggesting the possible installation of webshells or malicious JavaScript.
Read also: 7-Zip vulnerability allows hackers to execute arbitrary code
VulnCheck 's analysis revealed that only 1% of ProjectSend examples accessible online are using the updated version (r1750). Strikingly, 55% are still using the vulnerable version r1605, released in October 2022, while 44% are using an anonymous version from April 2023.
Organizations using ProjectSend are urged to immediately upgrade to version r1720 or later to mitigate this critical security. In addition, security teams should assess their exposure, implement necessary fixes, and undertake thorough response activities to detect potential breaches.
See more: Critical Kubernetes vulnerability allows hackers to execute arbitrary code
This incident highlights the importance of promptly implementing updates and the need for better coordination in vulnerability disclosure and CVE performance processes. As the threat landscape continues to evolve, continuous monitoring and maintaining up-to-date security measures remain critical for organizations of all sizes.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
