CVE-2020-28874
📋 TL;DR
CVE-2020-28874 is an authentication bypass vulnerability in ProjectSend's password reset functionality. Attackers can reset any user's password without proper token validation, potentially gaining unauthorized access. All ProjectSend instances before version r1295 are affected.
💻 Affected Systems
- ProjectSend
📦 What is this software?
Projectsend by Projectsend
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attackers reset administrator passwords, gain full control over the file sharing system, and access sensitive user files.
Likely Case
Unauthorized access to user accounts leading to data theft, file manipulation, or privilege escalation within the ProjectSend application.
If Mitigated
Limited impact with proper network segmentation and monitoring, though authentication bypass still poses significant risk.
🎯 Exploit Status
Simple HTTP request manipulation required; exploit code is publicly available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: r1295
Vendor Advisory: https://github.com/projectsend/projectsend/releases/tag/r1295
Restart Required: No
Instructions:
1. Backup current installation. 2. Download r1295 or later from GitHub releases. 3. Replace affected files, particularly reset-password.php. 4. Verify the commit 440204734e9a1687cb9887e1c887173d23c5a93e is applied.
🔧 Temporary Workarounds
Disable Password Reset
linuxTemporarily disable the password reset functionality by removing or restricting access to reset-password.php
mv /path/to/projectsend/reset-password.php /path/to/projectsend/reset-password.php.disabled
Web Server Access Control
allBlock access to reset-password.php using web server configuration
# Apache: <Location "/reset-password.php"> Require all denied </Location>
# Nginx: location = /reset-password.php { deny all; }
🧯 If You Can't Patch
- Implement network-level restrictions to limit access to ProjectSend only from trusted IP addresses
- Enable detailed logging of all password reset attempts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check if reset-password.php exists and compare its content with the patched version from commit 440204734e9a1687cb9887e1c887173d23c5a93eCheck Version:
grep -r 'r1295\|440204734e9a1687cb9887e1c887173d23c5a93e' /path/to/projectsend/Verify Fix Applied:
Verify the version is r1295 or later by checking the release files or commit history📡 Detection & Monitoring
Log Indicators:
- Multiple failed password reset attempts from single IP
- Successful password resets without corresponding user requests
- Unusual password reset patterns
Network Indicators:
- HTTP POST requests to reset-password.php with manipulated parameters
- Rapid sequential password reset attempts
SIEM Query:
source="web_logs" AND uri="/reset-password.php" AND (status=200 OR parameters CONTAINS "token=") | stats count by src_ip🔗 References
- http://projectsend.com
- https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e
- https://github.com/projectsend/projectsend/commits/master
- https://github.com/projectsend/projectsend/releases/tag/r1295
- https://github.com/varandinawer/CVE-2020-28874
- http://projectsend.com
- https://github.com/projectsend/projectsend/commit/440204734e9a1687cb9887e1c887173d23c5a93e
- https://github.com/projectsend/projectsend/commits/master
- https://github.com/projectsend/projectsend/releases/tag/r1295
- https://github.com/varandinawer/CVE-2020-28874
