Horizon Alert
Summary of the vulnerability and why it matters
ProjectSend versions prior to r1720 have an improper authentication flaw. This weakness allows unauthenticated attackers to alter application configurations. Such actions could lead to the creation of unauthorized accounts, the uploading of malicious files, or the embedding of harmful JavaScript within the system.
- Vulnerable component: ProjectSend application.
- Core weakness: Improper authentication.
- Main business impact: Unauthorized account creation and data compromise.
Attack Path
How an attacker could exploit the issue
An improper authentication vulnerability in ProjectSend versions prior to r1720 allows unauthenticated attackers to modify application configurations. Attackers can send specially crafted HTTP requests to options.php to gain unauthorized access. This can lead to the creation of new accounts, the upload of malicious webshells, and the injection of harmful JavaScript into the application.
- Exposed on the network.
- Attacker sends crafted HTTP requests.
- Attacker gains control of configuration.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in ProjectSend presents a significant risk due to its ease of exploitation and severe potential impact. Remote attackers without authentication can manipulate application settings, leading to the creation of unauthorized accounts, the upload of malicious files, and the injection of harmful scripts. The CISA Known Exploited Vulnerabilities catalog includes this CVE, indicating active exploitation and a heightened urgency for remediation.
- Likely attacker skill level: Basic
- Required access or conditions: Network accessible
- Business risk or urgency: High
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
An improper authentication vulnerability has been identified in ProjectSend, potentially allowing unauthenticated attackers to alter application configurations. Successful exploitation could lead to unauthorized account creation, the upload of malicious webshells, and the embedding of harmful JavaScript. This presents a significant risk to the integrity and security of organizational data and systems.
- Identify ProjectSend instances.
- Restrict network access.
- Apply vendor updates and verify.
- Monitor for suspicious activity.
