Wekan Header-Login IP Allowlist Bypass Vulnerability in Reverse-Proxy SSO

A vulnerability in Wekan's header-login feature prior to version 9.46 allows an unauthenticated attacker to bypass the IP allowlist and gain full access to any user account, including admin. The issue arises because the allowlist check relies on the client-controlled X-Forwarded-For header, which can be easily spoofed. Attackers who can reach the Wekan HTTP port directly can exploit this flaw by sending a request that appears to come from a trusted IP, along with a username header. This manipulation tricks the application into issuing a valid login token for the specified user, effectively enabling account takeover.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, including administrative privileges, by spoofing the source IP in the X-Forwarded-For header. This bypasses the header-login IP allowlist, which is meant to secure the login process by verifying the authenticity of the source IP through the reverse proxy.

Reproduction

To reproduce this vulnerability, upload the provided 'exploit.sh' and 'setup.sh' files to the same directory as the 'docker-compose.yml' file. Then, run the 'setup.sh' script to set up the environment, followed by the 'exploit.sh' script to trigger the vulnerability. The 'docker-compose.yml' file should be configured to enable header-login and set the allowlist to a trusted-proxy IP that is not the attacker's real address.

Remediation

Users must update to Wekan version 9.46 or later. After updating, it is crucial to set the 'HEADER_LOGIN_TRUSTED_IPS' environment variable to the IP address(es) of the reverse proxy. For deployments behind multiple proxy hops, 'HEADER_LOGIN_TRUSTED_PROXIES' can be used to specify intermediate proxy IPs.