Wekan Authorization Bypass Vulnerability in Copy Board DDP Method Allows Unauthorized Access to Private Boards

An authorization bypass vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This issue affects versions of Wekan prior to 9.32. The vulnerability arises in the 'copyBoard' Meteor DDP method, located in 'server/publications/boards.js'. The method allows any authenticated user to copy a board by providing a board ID, without verifying user ID, membership, or admin status. As a result, users can duplicate private boards they do not belong to, including all associated cards, checklists, custom fields, labels, and rules. In contrast, the equivalent REST API endpoint correctly enforces admin access requirements.

Impact

Exploitation of this vulnerability allows any authenticated user to copy private boards they are not a member of, including all cards, checklists, custom fields, labels, and rules. Additionally, the vulnerability could be exploited to inject arbitrary properties into the copied board, such as 'members' or 'permission', potentially leading to unauthorized access or exposure of information.

Reproduction

To reproduce this vulnerability, an authenticated user can call the 'copyBoard' Meteor method via a DDP client, such as the Meteor shell or a custom script. The request must include the ID of a private board the user is not a member of, along with any desired properties to inject into the copied board. The absence of authorization checks in the 'copyBoard' method will allow the user to successfully copy the private board and its contents.

Remediation

Users can upgrade to Wekan version 9.32 or later, where this vulnerability has been fixed.