Password Change Without Current Password in ProjectSend

Executive Summary

ProjectSend 2.5.0 to 2.6.9 has an unverified password change flaw in PasswordController::update(). Attackers with a stolen session cookie can send a PUT request to /settings/password to set a new local password without knowing the current one. This allows them to enroll their own second factor, remove the original provider access, and take over the account permanently.

Useful 0 Not Useful 0

Detection Guidance

Check ProjectSend version with: grep -r "version" /path/to/projectsend/config or check the admin panel. Look for unauthorized PUT requests to /settings/password in web server logs. Monitor for sudden local password changes on social-provisioned accounts without email reset requests.

Useful 0 Not Useful 0

Impact Analysis

If you use ProjectSend with social logins (LDAP, Microsoft, etc.), an attacker with a stolen session cookie could take over your account. They can set a new password, add their own second factor, and lock you out. Even after revoking the stolen session, the attacker retains access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate GDPR's data protection principles (Article 5) and HIPAA's security rule (45 CFR Part 164). Unverified password changes allow attackers to persistently control accounts, risking data breaches and non-compliance with access control requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ProjectSend to version 2.7.0 or later immediately. For versions below 2.7.0, disable social logins temporarily or enforce password resets via email for all accounts. Review logs for signs of exploitation and revoke any suspicious sessions.

Useful 0 Not Useful 0