Wekan SSRF (DnsBleed) and IDOR (ExcelBleed) Vulnerability Analysis

Vulnerability Overview DnsBleed Vulnerability Type: SSRF vulnerability, bypassed via DNS resolution of hostnames in outbound webhooks. Description: The synchronized URL validator parses all resolved IP addresses in outbound webhook (board integration) URLs and blocks private/loopback/local IP addresses. However, it failed to perform DNS resolution. If a public hostname resolved to a blocked address (e.g., → (cloud metadata), → ), or if an attacker-controlled domain had AAAA records pointing to an internal IP, it would bypass the string-based blocking. The report identifies the root weakness: string matching is not a sufficient SSRF boundary because it does not inspect the resolved IP. Fix: - Previous fixes blocked outbound webhooks sent via , a function that resolves hostnames, validates the resolved IP addresses, and blocks redirects before issuing the request. - This version completes the fix and removes the recommendation points regarding drift risks. - The delivery guard previously only resolved IPv4 records ( ), remaining blind to AAAA (internal-only) records. This caused false positives, rendered legitimate IPv6 webhooks unreachable, and maintained an incomplete private address block list susceptible to drift from synchronization. - now resolves both address families ( ), uses the same resolver call for the input validator, and validates all resolved IP addresses against a single shared block list. - The three previously separate block lists (pattern regex, delivery guard, input validator) are now a single source of truth. The pattern-level validator is documented in the code as a non-authoritative first-line UI check. - Affected: Wekan v8.36 and higher (input-side string validator). The SSRF boundary at delivery has existed since Wekan v8.35/v8.36 (IntegrationBleed) and v9.32 (WebhookBleed). Reported by: 4n207. ExcelBleed Vulnerability Type: Access control vulnerability in the Excel export REST route, allowing any authenticated user to export any private board. Description: The same class of unawaited asynchronous bugs affects BFLABleed (48 REST endpoints, v9.22), CloneBleed (unawaited , v9.35), and TokenBleed. Fix: - Fixed via an awaited guard: , aligning with other export routes ( , , , ). The Excel export route was the only remaining location with an unawaited call. - Affected: Wekan v9.57.0 (latest) and earlier versions; the issue existed in HEAD up to this version. Reported by: sec-reex (Defensive Research, responsible disclosure, read-only PoC). Impact Scope DnsBleed: Wekan v8.36 and higher. ExcelBleed: Wekan v9.57.0 and earlier. Remediation DnsBleed: - Use to resolve both address families ( ) and validate all resolved IP addresses against a single shared block list. - The three previously separate block lists are now consolidated into a single source of truth. The pattern-level validator is documented in the code as a non-authoritative first-line UI check. ExcelBleed: - Fix via an awaited guard: , matching the implementation in other export routes. POC Code No specific POC code is provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Wekan SSRF (DnsBleed) and IDOR (ExcelBleed) Vulnerability Analysis

More from this source