Wekan Attachment API Identity Spoofing and Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Wekan, an open-source kanban board system, in versions prior to 18.15. The issue arises in the attachment upload API, which improperly handles the Authorization bearer token by interpreting it as a user ID. This flaw allows for trivial application-layer denial-of-service attacks and potential identity spoofing by using arbitrary bearer tokens or user IDs.

Impact

Exploitation of this vulnerability could lead to application-layer denial-of-service conditions, such as hanging connections or excessive payloads, and allow for identity spoofing by using arbitrary bearer tokens or user IDs.

Reproduction

The vulnerability can be reproduced by sending a request to the attachment upload API with a non-empty Authorization bearer token. The API will treat the token as a user ID and bypass normal authentication, leading to denial-of-service conditions and allowing for identity spoofing.

Remediation

Users can update to Wekan version 18.16, where this vulnerability has been fixed.