CVE-2024-11680 is an improper authentication vulnerability in ProjectSend ProjectSend. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 December 2024, which means attackers have used it in real attacks. ProjectSend contains an improper authentication vulnerability that allows a remote, unauthenticated attacker to enable unauthorized modification of the application’s configuration via crafted HTTP requests to options.php.
What this vulnerability means in practice
Improper authentication means the application accepts requests that should require stronger proof of identity or session state. In a web application, that can turn a routine configuration path into an attacker-controlled control plane, especially when the vulnerable endpoint can change settings without a legitimate authenticated user.
For ProjectSend, the security issue is not just that authentication is weak, but that the trust boundary around options.php is broken. When an unauthenticated requester can alter configuration, the application can be redirected into unsafe states, including changes that affect access, storage, routing, or other operational behaviour.
Why this kind of flaw is dangerous
An improper authentication flaw in an administrative or configuration function can be more damaging than a simple content bug because configuration often determines the application’s security posture. If an attacker can change options, they may be able to weaken other protections, enable follow-on abuse, or create a foothold for later intrusion.
This class of flaw is dangerous because it bypasses intended trust checks rather than merely abusing a valid login. That makes it attractive in real-world attacks, and the fact that CISA added the issue to the NIST National Vulnerability Database and the CVE Program signals that defenders should treat it as a known, actively relevant exposure.
How organisations should assess exposure
Exposure assessment starts with knowing whether ProjectSend is deployed anywhere, who can reach it, and whether the vulnerable configuration endpoint is exposed beyond trusted administrative paths. Asset inventory matters because internet-facing instances and forgotten test deployments are the easiest to miss.
Defenders should review vendor advisories and CISA KEV status for authoritative patch and prioritisation detail, then confirm whether any instance accepts the affected request pattern from untrusted networks. For a broader vulnerability workflow, Vulnerability Management Guide is useful for prioritising known exploited issues against asset scope and remediation SLAs.
Remediation, detection, and post-exploitation review
Remediation should begin with applying the vendor fix as soon as it is available, or isolating the service if patching cannot happen immediately. If compensating controls are needed, restrict reachability to trusted administrative networks, place the application behind strong access controls, and monitor requests to configuration endpoints for signs of abuse.
Detection should focus on suspicious HTTP requests to options.php, unexplained configuration changes, and any downstream changes in authentication, upload handling, or administrative behaviour. After remediation, review logs and system state for signs that an attacker used the flaw before the patch, because configuration tampering can persist after the original request is gone. Where broader identity and session abuse is part of the incident response, the State of NHI & AI Agent Breach Report shows how credential and secret exposure often turns a single foothold into wider compromise.
Risk and Threat Considerations
An unauthenticated configuration flaw can become a high-impact entry point because it lets an attacker modify application behaviour without first stealing a password or session. In practice, that can expose data, weaken access controls, or prepare the application for later exploitation.
Failure mechanism: The attacker sends crafted requests to a configuration endpoint that should be protected, then abuses the resulting write access to alter security-sensitive settings or prepare persistence.
Impact: The organisation can lose trust in the application configuration, and the compromise may extend beyond the original endpoint into broader access, integrity, or operational exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | ProjectSend's flaw is an authentication failure around protected configuration access. |
| IA-5 — Authenticator Management | Post-exploitation review may require rotating credentials if configuration tampering enabled further compromise. | |
| Recommendation — Enforce authenticated access for administrative functions and verify no unauthenticated configuration path remains. Rotate affected authenticators and secrets if the application was altered or accessed through the flaw. | ||
| OWASP ASVS | V6 — Authentication | The issue is an improper authentication weakness in a web application request path. |
| V13 — Configuration | The vulnerable endpoint changes application configuration, making configuration hardening central. | |
| Recommendation — Verify that all state-changing endpoints require correct authentication before processing requests. Review configuration change paths and restrict them to trusted, authenticated administrative workflows. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | The flaw creates unauthorized access to configuration functions that should be restricted. |
| Recommendation — Limit administrative reachability and remove exposed paths that allow unauthorized configuration changes. | ||
| MITRE ATT&CK | T1190 — Exploit Public-Facing Application | The vulnerability enables remote unauthenticated abuse of a public web application endpoint. |
| Recommendation — Hunt for exploitation attempts against public-facing application endpoints and configuration handlers. | ||
Practitioner Guidance
Why practitioners should care: Configuration endpoints are often treated as internal-only functions, but if authentication is missing or malformed, they become a direct path to application compromise. That makes them high-value review items during vulnerability triage and incident response.
What to watch for: Treat any unauthenticated write path to settings, especially one reached through simple HTTP requests, as a likely abuse path rather than a cosmetic issue. Validate not only whether the patch is installed, but whether the instance was already touched before remediation.