CVE-2024-11680 Scanner
This scanner targets the registration settings and file extension whitelist endpoints in ProjectSend, allowing an attacker to bypass authorization and modify critical configurations.
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
1 month 19 days
Scan only one
Domain, Subdomain, IPv4
Toolbox
ProjectSend is an open-source file sharing platform used by organizations to securely distribute files among team members and external clients. It is popular in small to medium enterprises, legal firms, and consultancy sectors for its user-friendly interface and role-based access controls. Administrators rely on it to manage permissions, control downloads, and maintain data privacy in collaborative projects.
CVE-2024-11680 is an improper access control vulnerability that arises when ProjectSend fails to enforce proper authorization checks on certain administrative functions. This flaw allows unauthenticated or low-privilege users to access and modify sensitive settings without proper validation. The vulnerability stems from insufficient server-side verification of user roles and permissions.
Specifically, the vulnerability targets the registration settings and the whitelist of allowed file extensions within ProjectSend. Attackers can exploit these endpoints to enable self-registration or permit dangerous file types like executable scripts. The vulnerable functions lack adequate access control checks, making them accessible to any user who can reach the application.
If exploited, an attacker can gain unauthorized control over file upload policies, potentially leading to remote code execution or data breaches. With a CVSS score of 9.8, this vulnerability poses a critical risk, allowing complete compromise of the application and its data. Organizations may face data loss, regulatory penalties, and reputational damage if exploited.
