Wekan versions 8.32 and 8.33 allow attackers to access internal data

Summary

Wekan's board import feature can be exploited by attackers to access internal data and services. This is a serious issue, as it allows unauthorized access to sensitive information. Wekan version 8.34 fixes this issue, so update to the latest version to protect your data.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
wekan_project	wekan	8.32	–
wekan_project	wekan	8.33	–

Original title

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading. During board import in Wekan, attachme...

Original description

Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading. During board import in Wekan, attachment URLs from user-supplied JSON data are fetched directly by the server without any URL validation or filtering, affecting both the Wekan and Trello import flows. The parseActivities() and parseActions() methods extract user-controlled attachment URLs, which are then passed directly to Attachments.load() for download with no sanitization. This Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to make the server issue arbitrary HTTP requests, potentially accessing internal network services such as cloud instance metadata endpoints (exposing IAM credentials), internal databases, and admin panels that are otherwise unreachable from outside the network. This issue has been fixed in version 8.34.

nvd CVSS4.0 9.3

Vulnerability type

CWE-918 Server-Side Request Forgery (SSRF)