Executive Summary

This vulnerability in Wekan up to version 18.15 allows unauthenticated attackers to update a board's "sort" value because the Boards.allow function returns true without verifying the user's identity. This means attackers can arbitrarily reorder boards without being logged in or authorized. The issue was fixed in version 18.16 by introducing a strict authorization policy that only allows authenticated users who are members of a board to update the board's sort order. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to change the order of boards in your Wekan instance. This could lead to confusion, disruption of workflow, and potential manipulation of board organization, which may affect productivity and the integrity of your project management data. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection can focus on monitoring unauthorized update attempts to the board's 'sort' field without proper authentication or membership. Since the vulnerability involves unauthenticated users updating board sorting, you can check server logs or API request logs for update requests to the board resource that include the 'sort' field from unauthenticated sources or users not listed as board members. Specific commands depend on your logging setup, but for example, if you have access to logs, you might use commands like: 1. grep or similar to find update requests containing 'sort' field: `grep 'update.*sort' /path/to/wekan/logs` 2. Filter for unauthenticated or anonymous user IDs in logs. 3. Monitor API endpoints for update requests to boards and verify user authentication status. There is no explicit command provided in the resources, but focusing on logs for unauthorized 'sort' updates is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Wekan to version 18.16 or later, where the vulnerability is fixed. The fix enforces strict authorization policies that allow only authenticated users who are members of a board to update the board's 'sort' field. Until the upgrade is applied, you should restrict access to the Wekan instance to trusted users only and monitor for suspicious update attempts to the board sorting order. Applying the patch from commit ea310d7 or upgrading to the fixed version is the recommended action. [1, 3, 4]

Useful 0 Not Useful 0