ProjectSend is an open-source file sharing platform used by organizations to securely distribute files among team members and external clients. It is popular in small to medium enterprises, legal firms, and consultancy sectors for its user-friendly interface and role-based access controls. Administrators rely on it to manage permissions, control downloads, and maintain data privacy in collaborative projects.
CVE-2024-11680 is an improper access control vulnerability that arises when ProjectSend fails to enforce proper authorization checks on certain administrative functions. This flaw allows unauthenticated or low-privilege users to access and modify sensitive settings without proper validation. The vulnerability stems from insufficient server-side verification of user roles and permissions.
Specifically, the vulnerability targets the registration settings and the whitelist of allowed file extensions within ProjectSend. Attackers can exploit these endpoints to enable self-registration or permit dangerous file types like executable scripts. The vulnerable functions lack adequate access control checks, making them accessible to any user who can reach the application.
If exploited, an attacker can gain unauthorized control over file upload policies, potentially leading to remote code execution or data breaches. With a CVSS score of 9.8, this vulnerability poses a critical risk, allowing complete compromise of the application and its data. Organizations may face data loss, regulatory penalties, and reputational damage if exploited.
- Update ProjectSend to the latest patched version immediately.
- Restrict access to the settings page using IP whitelisting or VPN.
- Implement role-based access controls to enforce least privilege.
- Audit user accounts and remove any unauthorized or inactive users.
- Enable detailed logging for all configuration changes and monitor for anomalies.
- Disable self-registration if not required for business operations.
- Review and restrict allowed file extensions to only safe types.
- Conduct regular security assessments to identify similar access control flaws.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →