Wekan Privilege Escalation Vulnerability via Unauthenticated OIDC Methods

A vulnerability in Wekan's OIDC integration allows authenticated users to escalate privileges to admin. This issue affects Wekan versions prior to 9.32. The vulnerability arises because six Meteor methods related to OIDC are globally callable without authorization checks, unlike their non-OIDC counterparts which require admin rights. Exploitation of this vulnerability enables unauthorized creation and modification of organizations and teams, and can also grant global admin privileges under certain conditions.

Impact

Exploitation of this vulnerability allows authenticated users to gain global admin privileges, bypassing normal authorization requirements. This includes full control over all boards and users, as well as access to system settings. Additionally, the vulnerability allows for unauthorized creation and modification of organizations and teams.

Reproduction

To reproduce this vulnerability, log into a Wekan instance with an account that has OIDC integration. Once logged in, open the browser console and call one of the vulnerable OIDC methods, such as 'setCreateOrgFromOidc' or 'groupRoutineOnLogin', directly via DDP. This can be done by using 'Meteor.call' with the appropriate method name and parameters. For 'groupRoutineOnLogin', include a payload that grants admin rights. After executing the call, verify that the intended action was completed, such as the organization being created or the admin privileges being granted.

Remediation

Users can update to Wekan version 9.32 or later, where this vulnerability has been fixed.