Improper Authentication Vulnerability in ProjectSend Exposes Users to Attacks

What changed

ProjectSend has been found to contain an improper authentication vulnerability that affects versions prior to r1720. This flaw allows remote, unauthenticated attackers to exploit the application by sending specially crafted HTTP requests to the options.php file.

The successful exploitation of this vulnerability can lead to significant security issues, including unauthorized account creation, the ability to upload webshells, and the embedding of malicious JavaScript within the application.

Who is affected

The vulnerability primarily impacts users of the ProjectSend application, particularly those running versions earlier than r1720. This includes organizations and individuals who utilize ProjectSend for file sharing and project management.

Additionally, any web services relying on ProjectSend for secure file handling may also be at risk, potentially exposing sensitive data and compromising user accounts.

• Organizations using ProjectSend for file sharing.
• Developers and administrators of ProjectSend installations.
• Users who upload or share files via ProjectSend.
• Any third-party services integrated with ProjectSend.

What to do

It is crucial for users of ProjectSend to upgrade to version r1720 or later to mitigate the risks associated with this vulnerability. Regularly updating software can help protect against known security flaws.

In addition, administrators should review their server logs for any suspicious activity and ensure that proper security measures are in place to prevent unauthorized access.

• Upgrade to ProjectSend version r1720 or later.
• Conduct a security audit of existing installations.
• Implement additional security measures, such as firewalls and intrusion detection systems.
• Educate users about the risks of improper authentication vulnerabilities.