erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: July 19, 2024

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: ProjectSend CVE-2024-11680: Unauthenticated Config Takeover. Anyone self-hosting ProjectSend r1605 or another release before r1720, especially on a public URL for client file exchange.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2024-11680

ProjectSend CVE-2024-11680: Unauthenticated Config Takeover

Any internet-facing ProjectSend older than r1720 should be presumed backdoored; upgrade it, then check settings and upload/files/ for webshells.

Must act: Anyone self-hosting ProjectSend r1605 or another release before r1720, especially on a public URL for client file exchange.

Can relax: Instances on r1720 or later, or on the rewritten ProjectSend 2 (2.7.1 is current), with no unexplained settings changes or files in upload/files/.

  1. Find every ProjectSend install and confirm it is r1720 or later, or migrate it to ProjectSend 2.
  2. Add php_flag engine off to upload/files/.htaccess (or the equivalent web server rule) so uploaded scripts cannot run.
  3. Review settings: turn off client self-registration and auto-approval unless you use them, and remove php, phtml and similar types from allowed extensions.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.