ProjectSend CVE-2024-11680: Unauthenticated Config Takeover

What to do

1. Find every ProjectSend install and confirm it is r1720 or later, or migrate it to ProjectSend 2.
2. Add php_flag engine off to upload/files/.htaccess (or the equivalent web server rule) so uploaded scripts cannot run.
3. Review settings: turn off client self-registration and auto-approval unless you use them, and remove php, phtml and similar types from allowed extensions.
4. Delete accounts you did not create and reset administrator passwords.
5. If the instance was exposed before upgrading, treat it as compromised and rebuild from a clean copy.

How to check if you are affected or compromised

• Check whether the landing page title became a long random string, the marker left by the public Nuclei and Metasploit checks.
• List files in upload/files/ with script extensions such as .php or .phtml, named timestamp-sha1(username)-filename.
• Search access logs for POST requests to options.php from unauthenticated sessions and for direct GET requests to upload/files/.
• Look for user registration switched on, new client accounts, or JavaScript added to settings that you did not make.

What happened#

ProjectSend is an open-source PHP application that companies use to share files with clients. In January 2023, Synacktiv researchers Florent Sicchio and Hugo Clout told the maintainer that several pages ran their authorization check only after processing the request. Their advisory shows that an unauthenticated POST to options.php could rewrite the configuration. With it, an attacker can enable self-registration and auto-approval, add .phtml to the allowed upload types, upload PHP code, and run it from upload/files/.

The maintainer fixed the code on May 16, 2023, in commit 193367d, but no release shipped it. Synacktiv asked for a release date four times, then published on July 19, 2024. Release r1720 followed on August 3, 2024. Metasploit and Nuclei pull requests with working checks followed on August 30 and September 3. No CVE existed until VulnCheck assigned CVE-2024-11680 and published it on November 26, 2024. NVD scores it 9.8.

The exploitation that put it in KEV came from VulnCheck's report. Starting in September 2024, it saw public ProjectSend servers whose landing-page titles had changed to long random strings, the fingerprint of the public exploit tools. It also saw registration switched on and webshells deployed. Of more than 4,000 instances indexed by Censys, VulnCheck estimated only about 1% were patched. CISA added the CVE to KEV on December 3, 2024.

Who is affected#

The CVE record covers every ProjectSend release before r1720. Synacktiv tested r1605 and says releases after r1270 may also be affected. In August 2026 the project shipped ProjectSend 2, a ground-up rewrite installed fresh with a migration tool. The current release is 2.7.1. The older v1 code now lives in a separate ProjectSend Legacy repository.

Do you really need to act?#

Only if you run ProjectSend, but then probably yes. The tool is usually exposed on purpose, since clients need to reach it. Installs tend to be set up once and forgotten, and the fix sat unreleased for nearly 15 months. VulnCheck found 99% of exposed servers unpatched in late 2024. If yours was older than r1720 and reachable during that window, assume someone tried it.

What to do now#

1. Confirm the version of each install. VulnCheck notes the landing page embeds the release date. Upgrade anything older than r1720, or move to ProjectSend 2.
2. Block script execution in uploads: echo "php_flag engine off" >> upload/files/.htaccess on Apache with mod_php, or a matching rule on nginx.
3. In settings, disable client self-registration and auto-approval if unused, and strip php, phtml and similar types from allowed extensions.
4. Remove accounts you did not create and reset administrator passwords.
5. If you find a webshell, rebuild from a clean copy and rotate the database and mail credentials in the config.

How to tell if you were hit#

Run curl -s https://files.example.com/ | grep -i '<title>' and look for a random string such as "Log in » 2nVsqpahM2JlULBOKl4HZg2JMXb". List scripts with find upload/files -type f \( -name '*.php' -o -name '*.phtml' \). Uploads are named {timestamp}-{sha1(username)}-{filename}, so the timestamp dates the upload. Grep access logs for POST requests to options.php and direct GET requests to upload/files/. Downloads normally use a different endpoint, so those requests are suspicious.

Timeline#

• Jan 19, 2023 — Synacktiv reports the flaw to the maintainer.
• May 16, 2023 — Fix committed (193367d), not yet released.
• Jul 19, 2024 — Synacktiv publishes its advisory.
• Aug 3, 2024 — ProjectSend r1720 ships the fix.
• Nov 26, 2024 — CVE-2024-11680 published; VulnCheck reports exploitation since September.
• Dec 3, 2024 — CISA adds it to KEV; the federal deadline is December 24, 2024.
• Oct 22, 2026 — ProjectSend 2.7.1 is the current release.

Vulnerability records

• CVE-2024-11680 · KEV 2024-12-03 · ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Synacktiv — Improper authorization check in ProjectSend <= r1605 (advisory PDF) synacktiv.com
2. ProjectSend — Commit 193367d: Check user session before starting to process data github.com
3. ProjectSend — Release 2.7.1 github.com
4. CVE record — CVE-2024-11680 cve.org
5. NVD — CVE-2024-11680 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2024-11680 cisa.gov
7. VulnCheck — ProjectSend Unauthenticated Configuration Modification vulncheck.com
8. VulnCheck — ProjectSend exploited in the wild vulncheck.com