Wekan Stored Cross-Site Scripting Vulnerability via Unrestricted Content-Type in File Attachments

A stored cross-site scripting vulnerability has been identified in Wekan, an open-source kanban board application, in versions prior to 18.15. The issue arises from file attachments being served with an attacker-controlled Content-Type of 'text/html'. This allows the execution of malicious HTML or JavaScript in the application's origin, potentially leading to theft of session tokens and execution of cross-site request forgery actions.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where uploaded attachments can execute malicious scripts when accessed.

Reproduction

To reproduce this vulnerability, upload a file attachment with a Content-Type of 'text/html' to a Wekan board. Once the file is uploaded, it will be served with the specified Content-Type, allowing any embedded JavaScript to execute in the context of the application.

Remediation

Users can update to Wekan version 18.16 or later, where this vulnerability has been fixed.