CVE-2024-7659: ProjectSend RCE Vulnerability

CVE-2024-7659 Overview

CVE-2024-7659 affects ProjectSend versions up to r1605, a self-hosted file sharing application. The vulnerability resides in the generate_random_string function within includes/functions.php, which the Password Reset Token Handler component uses to produce reset tokens. The function generates insufficiently random values, weakening the entropy of password reset tokens [CWE-330]. Remote attackers can attempt to predict or brute-force these tokens to hijack accounts. The attack complexity is high, and exploitation is considered difficult. Upgrading to release r1720 resolves the issue through commit aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17.

Critical Impact
Predictable password reset tokens can allow remote attackers to take over ProjectSend user accounts without prior authentication.

Affected Products

ProjectSend releases up to and including r1605
ProjectSend includes/functions.php (generate_random_string)
ProjectSend Password Reset Token Handler component

Discovery Timeline

2024-08-12 - CVE-2024-7659 published to NVD
2024-08-15 - Last updated in NVD database

Technical Details for CVE-2024-7659

Vulnerability Analysis

The vulnerability stems from weak randomness in the generate_random_string function that backs password reset token generation. ProjectSend uses this function to issue tokens that authenticate password reset requests. Because the source of randomness does not provide cryptographically strong entropy, an attacker who can observe or reason about token outputs may narrow the search space for valid tokens. The flaw is classified under [CWE-330] Use of Insufficiently Random Values. Successful exploitation targets confidentiality by enabling unauthorized account access through the reset workflow. The maintainers replaced the routine in commit aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17, included in release r1720.

Root Cause

The generate_random_string routine in includes/functions.php relied on a random source that lacked the unpredictability required for security-sensitive tokens. Password reset tokens must be generated with a cryptographically secure pseudo-random number generator (CSPRNG). When tokens are drawn from a weak source, their values become predictable across requests or within constrained ranges.

Attack Vector

The attack is launched remotely over the network without authentication or user interaction. An attacker initiates a password reset request for a target account and then attempts to guess or brute-force the resulting token to complete the reset and seize the account. The exploitation complexity is high because attackers must reason about token structure and may need many requests to succeed.

No verified proof-of-concept code is publicly available for this issue. The upstream patch in commit aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17 documents the corrected token generation logic. See the ProjectSend patch commit and ProjectSend release r1720 for technical details.

Detection Methods for CVE-2024-7659

Indicators of Compromise

High volumes of password reset requests targeting one or more user accounts within short time windows.
Repeated HTTP requests to ProjectSend reset endpoints presenting varying token values.
Successful password resets immediately followed by logins from unfamiliar IP addresses or user agents.

Detection Strategies

Inspect ProjectSend web server access logs for bursts of requests against reset URLs containing token parameters.
Correlate password reset events with subsequent authentication events to identify rapid takeover patterns.
Verify the running ProjectSend version against r1720 to confirm whether the vulnerable code path is present.

Monitoring Recommendations

Forward ProjectSend application and web server logs to a centralized logging or SIEM platform for anomaly analysis.
Alert on threshold breaches for password reset attempts per account or per source IP.
Track changes to account email addresses and credentials following reset events.

How to Mitigate CVE-2024-7659

Immediate Actions Required

Upgrade ProjectSend to release r1720 or later, which includes commit aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17.
Invalidate outstanding password reset tokens issued by vulnerable versions.
Audit recent password reset events and account changes for signs of unauthorized access.

Patch Information

The fix is delivered in ProjectSend release r1720. The patch commit aa27eb97edc2ff2b203f97e6675d7b5ba0a22a17 replaces the insufficiently random implementation in generate_random_string. Operators should review the GitHub commit and apply the r1720 release.

Workarounds

Restrict access to the ProjectSend instance using network controls such as VPN or IP allowlisting until the upgrade is complete.
Enforce rate limiting on password reset endpoints at the reverse proxy or web application firewall.
Require administrator-assisted password resets temporarily and disable self-service reset where feasible.

bash

# Example NGINX rate limit for ProjectSend password reset endpoint
limit_req_zone $binary_remote_addr zone=psend_reset:10m rate=5r/m;

location /reset-password.php {
    limit_req zone=psend_reset burst=5 nodelay;
    proxy_pass http://projectsend_backend;
}