CVE-2021-40887
📋 TL;DR
CVE-2021-40887 is a critical directory traversal vulnerability in ProjectSend file sharing software that allows attackers to upload arbitrary files to any location on the server. This affects all users running ProjectSend r1295 who have file upload functionality enabled. Attackers can exploit this to upload malicious PHP files and potentially achieve remote code execution.
💻 Affected Systems
- ProjectSend
📦 What is this software?
Projectsend by Projectsend
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Unauthorized file upload leading to web shell deployment and limited server compromise.
If Mitigated
File upload attempts blocked or logged with no successful exploitation.
🎯 Exploit Status
Exploitation requires only web access to the upload endpoint with directory traversal payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: r1296 and later
Vendor Advisory: https://github.com/projectsend/projectsend/issues/994
Restart Required: No
Instructions:
1. Backup current installation. 2. Download latest version from official repository. 3. Replace vulnerable files with patched version. 4. Verify file permissions are correct.
🔧 Temporary Workarounds
Input Validation Filter
allAdd server-side validation to reject file paths containing directory traversal sequences
Modify upload handler to sanitize filenames using: preg_replace('/\.\.\//', '', $filename)
Web Application Firewall Rule
allBlock requests containing directory traversal patterns in file upload parameters
WAF rule: Block if ARGS:files[] contains '../'
🧯 If You Can't Patch
- Disable file upload functionality completely in ProjectSend configuration
- Implement strict file extension whitelisting and store uploaded files outside web root
🔍 How to Verify
Check if Vulnerable:
Check if running ProjectSend version r1295 by examining version files or admin panelCheck Version:
Check /includes/version.php or admin dashboard for version informationVerify Fix Applied:
Test file upload with traversal payloads (e.g., '../../malicious.php') - should be rejected📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to upload endpoints with '../' in parameters
- File write operations outside expected upload directory
Network Indicators:
- Unusual file upload patterns with traversal sequences
- POST requests to /upload/ with abnormal filenames
SIEM Query:
source="web_logs" AND (uri_path="/upload/" OR uri_path="/includes/upload/") AND (http_method="POST") AND (request_body MATCHES "\.\./")