CVE-2024-7658
📋 TL;DR
This vulnerability in ProjectSend allows improper control of resource identifiers in the get_preview function of process.php, potentially enabling unauthorized access to files. It affects ProjectSend installations up to version r1605. Remote attackers could exploit this to access restricted resources.
💻 Affected Systems
- ProjectSend
📦 What is this software?
Projectsend by Projectsend
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to sensitive files stored in ProjectSend, potentially including confidential documents or system files.
Likely Case
Limited file disclosure or directory traversal to access files within the ProjectSend directory structure.
If Mitigated
No impact if proper file permissions and access controls are configured.
🎯 Exploit Status
The vulnerability description indicates remote exploitation is possible, suggesting low complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: r1720
Vendor Advisory: https://github.com/projectsend/projectsend/releases/tag/r1720
Restart Required: No
Instructions:
1. Backup your current ProjectSend installation and database. 2. Download version r1720 from the official GitHub releases. 3. Replace the existing files with the new version, preserving your configuration files. 4. Verify the patch commit eb5a04774927e5855b9d0e5870a2aae5a3dc5a08 is present.
🔧 Temporary Workarounds
Restrict access to process.php
allTemporarily block or restrict access to the vulnerable process.php file
# For Apache: Add to .htaccess
<Files "process.php">
Order Deny,Allow
Deny from all
</Files>
# For Nginx: Add to server block
location ~ /process\.php$ {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict file permissions and access controls on the ProjectSend directory
- Deploy a web application firewall (WAF) with rules to block resource identifier manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Check your ProjectSend version by examining the version file or checking the admin panel. If version is r1605 or earlier, you are vulnerable.Check Version:
grep -r 'version' includes/version.php 2>/dev/null || cat includes/version.phpVerify Fix Applied:
Verify the patch commit eb5a04774927e5855b9d0e5870a2aae5a3dc5a08 exists in your installation by checking git history or file timestamps.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to process.php with get_preview parameter
- Multiple failed attempts to access restricted file paths
Network Indicators:
- HTTP requests to process.php with suspicious resource identifiers in parameters
SIEM Query:
source="web_logs" AND uri="*process.php*" AND (query="*get_preview*" OR query="*resource*" OR query="*file*")🔗 References
- https://github.com/projectsend/projectsend/commit/eb5a04774927e5855b9d0e5870a2aae5a3dc5a08
- https://github.com/projectsend/projectsend/releases/tag/r1720
- https://vuldb.com/?ctiid.274115
- https://vuldb.com/?id.274115
- https://vuldb.com/?submit.385000
- https://www.kiyell.com/private-files-from-projectsend-idor/
