Message-ID: <4244dd97-0f37-d504-349a-337277df2224@sec-consult.com>
Date: Wed, 17 May 2023 07:29:45 +0000
From: "SEC Consult Vulnerability Lab,
 Research via Fulldisclosure" <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] SEC Consult SA-20230517-0 :: Stored XSS vulnerability in
 rename functionality in Wekan (Open-Source kanban)

SEC Consult Vulnerability Lab Security Advisory < 20230517-0 >
=======================================================================
               title: Stored XSS vulnerability in rename functionality
             product: Wekan (Open-Source kanban)
  vulnerable version: <=6.74
       fixed version: 6.75 or higher
          CVE number: CVE-2023-28485
              impact: Medium
            homepage: https://wekan.github.io
               found: 2022-12-30
                  by: Heiner Liesegang (Office Berlin)
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult.
                      SEC Consult is part of Eviden, an Atos business
                      Europe | Asia | North America
                      https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"WeKan ® is an completely Open Source and Free software collaborative
kanban board application with MIT license.

Whether you’re maintaining a personal todo list,
planning your holidays with some friends,
or working in a team on your next revolutionary idea, Kanban boards
are an unbeatable tool to keep your things organized.
They give you a visual overview of the current state of your project,
and make you productive by allowing you to focus on the few items that
matter the most."

Source: https://github.com/wekan/wekan


Business recommendation:
------------------------
Patch the application with the latest update supplied by the vendor.


Vulnerability overview/description:
-----------------------------------
1) Stored Cross-Site Scripting (CVE-2023-28485)
An authenticated attacker with the role 'BoardAdmin' is able to rename
file attachments of Kanban cards. Being an admin of the Wekan instance
is not required in order for this exploit to work, as any user can
obtain 'BoardAdmin' privileges by creating a new Kanban board.

The 'renameAttachment' method does not sanitise user input and allows embedding
XSS payloads in the specified filename. The stored XSS payload is triggered by
opening the attachment as the modified filename is displayed in the header bar
of the file preview.


Proof of concept:
-----------------
1) Stored Cross-Site Scripting (CVE-2023-28485)
The following steps are necessary to exploit the vulnerability:
   1. Log into the application with at least "user" privileges
  2a. Open a Kanban board in which you have 'BoardAdmin' privileges
  2b. Or, create a new Kanban board otherwise
   3. Create a Kanban card if none exists
   4. Open Kanban card to edit it
   5. If there is no attachment in the card, upload one
   6. Click on "Attachment Actions" under the attachment and select "Rename"
   7. Include arbitrary XSS payload such as the following inside the filename:
      "<script>alert('Stored XSS')</script>"
   8. Select "Save" to embed the XSS payload

Any user with access to the board clicking on the attachment preview
triggers the stored XSS. In case the used Kanban board is set to "public"
any person with a link to the board can access the targeted card and
trigger the payload inside the attachments' filename.


Vulnerable / tested versions:
-----------------------------
The following versions have been tested to be vulnerable:
* v6.64
* v6.69
* v6.71

According to the vendor, all versions before 6.75 are affected as well.


Vendor contact timeline:
------------------------
2023-02-16: Contacting vendor security contact through support@...an.team.
2023-02-21: Vendor responded requesting a recheck of fixes in version 6.75.
2023-02-27: Security patch is confirmed to fix vulnerability.
2023-03-14: CVE number requested.
2023-05-17: Public release of security advisory.


Solution:
---------
The vendor provides a patched version which should be installed immediately.
The version 6.75 or higher provides the corresponding security patch:
https://github.com/wekan/wekan


Workaround:
-----------
None


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult is part of Eviden, an Atos business
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, part
of Eviden, an Atos business. It ensures the continued knowledge gain of SEC
Consult in the field of network and application security to stay ahead of the
attacker. The SEC Consult Vulnerability Lab supports high-quality penetration
testing and the evaluation of new offensive and defensive technologies for our
customers. Hence our customers obtain the most current information about
vulnerabilities and valid recommendation about the risk profile of new
technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Heiner Liesegang / @2023
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists