Stored XSS vulnerability in rename functionality in Wekan (Open-Source kanban)

Title

Stored XSS vulnerability in rename functionality

Product

Wekan (Open-Source kanban)

Vulnerable Version

<=6.74

Fixed Version

6.75 or higher

CVE Number

CVE-2023-28485

Impact

medium

Homepage

https://wekan.github.io

Found

30.12.2022

By

Heiner Liesegang (Office Berlin) | SEC Consult Vulnerability Lab

The project management software WeKan is vulnerable and allows attackers to embed arbitrary scripts in filenames which get executed upon viewing. The rename functionality allows attackers to set filenames to arbitrary values and embed text which is interpreted directly by the browser instead of being filtered. An attacker can embed JavaScript this way which gets executed inside a user's browser when clicking the modified file.

Vendor description

"WeKan ® is an completely Open Source and Free software collaborative kanban board application with MIT license. Whether you’re maintaining a personal todo list, planning your holidays with some friends, or working in a team on your next revolutionary idea, Kanban boards are an unbeatable tool to keep your things organized. They give you a visual overview of the current state of your project, and make you productive by allowing you to focus on the few items that matter the most."

Source: https://github.com/wekan/wekan


Business recommendation

Patch the application with the latest update supplied by the vendor.


Vulnerability overview/description

1) Stored Cross-Site Scripting (CVE-2023-28485)

An authenticated attacker with the role 'BoardAdmin' is able to rename file attachments of Kanban cards. Being an admin of the Wekan instance is not required in order for this exploit to work, as any user can obtain 'BoardAdmin' privileges by creating a new Kanban board.

The 'renameAttachment' method does not sanitise user input and allows embedding XSS payloads in the specified filename. The stored XSS payload is triggered by opening the attachment as the modified filename is displayed in the header bar of the file preview.


Proof of concept

1) Stored Cross-Site Scripting (CVE-2023-28485)

The following steps are necessary to exploit the vulnerability:

 1. Log into the application with at least "user" privileges

 2a. Open a Kanban board in which you have 'BoardAdmin' privileges

 2b. Or, create a new Kanban board otherwise

 3. Create a Kanban card if none exists

 4. Open Kanban card to edit it

 5. If there is no attachment in the card, upload one

 6. Click on "Attachment Actions" under the attachment and select "Rename"

 7. Include arbitrary XSS payload such as the following inside the filename:  "<script>alert('Stored XSS')</script>"

 8. Select "Save" to embed the XSS payload

Any user with access to the board clicking on the attachment preview triggers the stored XSS. In case the used Kanban board is set to "public" any person with a link to the board can access the targeted card and trigger the payload inside the attachments' filename.


Vulnerable / tested versions

The following versions have been tested to be vulnerable:

  • v6.64
  • v6.69
  • v6.71

According to the vendor, all versions before 6.75 are affected as well.


Vendor contact timeline

2023-02-16 Contacting vendor security contact through support@wekan.team
2023-02-21 Vendor responded requesting a recheck of fixes in version 6.75.
2023-02-27 Security patch is confirmed to fix vulnerability.
2023-03-14 CVE number requested.
2023-05-17 Public release of security advisory.

Solution

The vendor provides a patched version which should be installed immediately. The version 6.75 or higher provides the corresponding security patch:
https://github.com/wekan/wekan/


Workaround

None


Advisory URL

https://sec-consult.com/vulnerability-lab/

 

EOF Heiner Liesegang / @2023

 

Interested to work with the experts of SEC Consult? Send us your application

Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices 

Back