WeKan v9.32 Security Advisory: SSRF, Privilege Escalation, Auth Bypass, and More

Vulnerability Overview WeKan v9.32 fixes multiple critical security vulnerabilities, including Server-Side Request Forgery (SSRF), authorization bypass, privilege escalation, unauthorized access, account merging vulnerabilities, custom field read/write permission issues, external antivirus scanner vulnerabilities, regular expression Denial of Service (DoS), incomplete string escaping/encoding, incomplete multi-character escaping, useless regular expression character escaping, sensitive information logging, missing workflow permissions, insecure random number generation, and iOS Chrome jQuery event handler runtime errors. Affected Scope SSRF Vulnerability: WeKan's outbound webhook integration allows attackers to access internal services or extract data by controlling URLs to point to internal services or metadata. Authorization Bypass: The Meteor method allows any user to copy private boards, leading to privilege escalation. Privilege Escalation: Six Meteor methods allow unauthorized users to escalate privileges to administrator via OIDC login. Unauthorized Access: The hook unconditionally merges OIDC logins into existing WeKan accounts, causing an account merging vulnerability. Custom Field Read/Write Permission Issues: Read-only board members can create, modify, and delete custom fields. External Antivirus Scanner Vulnerability: The antivirus command line configured by administrators still uses the deprecated , leading to potential security issues. Regular Expression DoS: Regular expressions in the Jade parser can cause Denial of Service. Incomplete String Escaping/Encoding: Incomplete string escaping/encoding in can lead to security issues. Incomplete Multi-Character Escaping: Incomplete multi-character escaping in . Useless Regular Expression Character Escaping: Useless regular expression character escaping in . Sensitive Information Logging: Sensitive information logging in and . Missing Workflow Permissions: Workflows do not include permission checks. Insecure Random Number Generation: Insecure random number generation. iOS Chrome jQuery Event Handler Runtime Error: jQuery event handler runtime errors on iOS Chrome. Remediation SSRF Vulnerability: Add input validation in , using and methods to verify URLs. Authorization Bypass: Add authorization checks in to ensure only board members can copy boards. Privilege Escalation: Add authorization checks in and to ensure only authenticated users can use OIDC login. Unauthorized Access: Add ownership checks in to ensure only matching users can merge accounts. Custom Field Read/Write Permission Issues: Use instead of in to ensure only users with write permissions can operate on custom fields. External Antivirus Scanner Vulnerability: Use instead of in . Regular Expression DoS: Remove redundant anchors in and the bundled . Incomplete String Escaping/Encoding: Fix string escaping/encoding issues in . Incomplete Multi-Character Escaping: Fix multi-character escaping issues in . Useless Regular Expression Character Escaping: Fix useless regular expression character escaping issues in . Sensitive Information Logging: Remove sensitive information logging in and . Missing Workflow Permissions: Add permission checks to workflows. Insecure Random Number Generation: Fix random number generation issues. iOS Chrome jQuery Event Handler Runtime Error: Fix jQuery event handler runtime errors on iOS Chrome. Proof of Concept (POC) Code No specific POC code or exploit code is included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

WeKan v9.32 Security Advisory: SSRF, Privilege Escalation, Auth Bypass, and More

More from this source