Critical Improper Authentication in ProjectSend (CVE‑2024‑11680) Enables Unauthorized Configuration Changes
What It Is
ProjectSend suffers from an improper authentication flaw in its options.php endpoint. An unauthenticated remote attacker can craft HTTP requests that bypass login checks and modify the application’s configuration.
Exploitability
The vulnerability is rated Critical (CVSS 9.8) and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Public proof‑of‑concept code has been released, demonstrating the ability to create new user accounts, upload web‑shells, and inject malicious JavaScript.
Affected Products
- Vendor: ProjectSend
- Product: ProjectSend (all supported versions prior to the vendor‑issued patch)
Why It Matters for Compliance & Audit Readiness
Improper authentication directly undermines access control requirements under frameworks such as NIST CSF PR.AC‑1 and ISO 27001 A.9.2. For organizations that must demonstrate continuous control monitoring, this flaw creates a gap in the evidence of due‑diligence for privileged‑account management. Failure to remediate can invalidate audit assertions about the integrity of configuration settings and the segregation of duties, exposing the entity to regulatory penalties and loss of trust.
Recommended Actions
- Patch Immediately: Apply the vendor‑released fix for CVE‑2024‑11680.
- Validate Configuration Integrity: Conduct a post‑patch review of
options.phpand related settings to ensure no unauthorized changes remain. - Strengthen Access Controls: Enforce multi‑factor authentication for administrative interfaces and restrict access to
options.phpvia network segmentation or web‑application firewalls. - Update Vendor‑Management Evidence: Document the remediation steps in your vendor‑risk register and retain logs as audit‑ready evidence of control remediation.
- Continuous Monitoring: Enable logging of all requests to
options.phpand integrate alerts into your SIEM for anomalous activity.
Source: CISA KEV – CVE‑2024‑11680