CVE-2025-65781

Executive Summary

CVE-2025-65781 is a critical vulnerability in Wekan, an open-source kanban board system, affecting versions up to 18.15. The flaw resides in the attachment upload API, where the Authorization bearer token is incorrectly treated as a userId. This leads to a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer Denial of Service (DoS) and latent identity-spoofing. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but based on the description, it poses a significant risk to availability and potentially to authentication integrity. The patch is available in version 18.16.

Supply Chain & Package Security

Wekan is a Node.js application typically deployed via Docker, npm, or direct source. The vulnerability is in the core application code, not in a third-party package. However, organizations using Wekan should verify their deployment method and ensure they are not using a compromised or outdated container image. The fix is included in the official Wekan repository and Docker images tagged 18.16 or later.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed to trigger the DoS.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): None (N) - No data is modified.
• Availability (A): High (H) - The service can be completely disrupted.

Threat Level: High (7.5) - The ease of exploitation and potential for complete service disruption make this a high-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is in the attachment upload API endpoint. When a request is made to upload a file, the server extracts the Authorization header and uses the bearer token value as a userId. This userId is then used in a body-handling branch that, for any non-empty token, enters a non-terminating loop or consumes excessive resources, leading to a Denial of Service.

Root Cause: The code does not validate the bearer token against a valid user session. Instead, it directly uses the token value as a user identifier, which is then processed in a way that causes resource exhaustion.

Attack Vector: An attacker sends a crafted HTTP request to the attachment upload endpoint with any non-empty bearer token (e.g., Authorization: Bearer AAAA). The server then enters a non-terminating body-handling branch, consuming CPU and memory, and eventually crashing or becoming unresponsive.

Latent Identity-Spoofing: While the primary impact is DoS, the fact that the bearer token is treated as a userId suggests that if an attacker can control the token value, they might be able to impersonate a user with that ID, potentially leading to unauthorized access or data manipulation.

Vulnerable vs. Patched Code

Vulnerable Code (Wekan <= 18.15):

// Simplified vulnerable code
app.post('/api/attachments', (req, res) => {
  const userId = req.headers['authorization'].replace('Bearer ', '');
  // Non-terminating body-handling branch for any non-empty userId
  while (userId.length > 0) {
    // Process attachment - but never exits for non-empty tokens
    // This loop consumes resources indefinitely
  }
});

Patched Code (Wekan >= 18.16):

// Simplified patched code
app.post('/api/attachments', (req, res) => {
  const token = req.headers['authorization'].replace('Bearer ', '');
  // Validate token against session store
  const userId = validateToken(token);
  if (!userId) {
    return res.status(401).send('Unauthorized');
  }
  // Properly handle attachment upload with validated userId
  processAttachment(userId, req.body);
});

The patch adds proper token validation and ensures that the body-handling branch only executes for valid, authenticated users.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Wekan version <= 18.15.
• Network access to the Wekan API endpoint.

Exploit Steps:

1. Identify the Wekan instance and its API endpoint (e.g., https://target-wekan.example.com).
2. Send a crafted POST request to the attachment upload endpoint with a non-empty bearer token.

Example Exploit (using curl):

curl -X POST https://target-wekan.example.com/api/attachments \
  -H "Authorization: Bearer AAAA" \
  -H "Content-Type: multipart/form-data" \
  -F "file=@/dev/null"

Expected Outcome: The server will become unresponsive or crash, causing a Denial of Service.

Blue Team (Detection & Defense)

Detection:

• Monitor for a high number of requests to /api/attachments with invalid or non-standard bearer tokens.
• Look for server logs showing repeated attempts to process attachments with empty or malformed tokens.
• Use the detection rules provided in the Detection Engineering section.

Defense:

• Immediately upgrade to Wekan version 18.16 or later.
• Implement a Web Application Firewall (WAF) rule to block requests to /api/attachments with non-standard bearer tokens.
• Rate-limit API endpoints to mitigate DoS attacks.
• Monitor server resource usage (CPU, memory) for anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/attachments with Authorization: Bearer header containing non-standard values (e.g., AAAA, test, 1234).
  • Repeated 500 or 503 errors from the Wekan server.
• System IOCs:
  • High CPU and memory usage on the Wekan server.
  • Wekan process crashes or restarts.
  • Log entries showing Error: body-handling branch non-terminating or similar.

Detection Engineering

YARA Rule

rule CVE_2025_65781_Wekan_DoS {
  meta:
    description = "Detects exploitation attempts for CVE-2025-65781 in Wekan"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-65781"
  strings:
    $bearer = "Authorization: Bearer"
    $endpoint = "/api/attachments"
    $non_standard = /Bearer\s+[A-Za-z0-9]{1,10}/  // Short or non-standard tokens
  condition:
    $bearer and $endpoint and $non_standard
}

Sigma Rule

title: CVE-2025-65781 Wekan Attachment Upload DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts for CVE-2025-65781
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: wekan
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem: '/api/attachments'
    cs(User-Agent): '*'
  condition: selection
falsepositives:
  - Legitimate attachment uploads with valid tokens
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-65781 Wekan Attachment Upload DoS"; flow:to_server; content:"POST"; http_method; content:"/api/attachments"; http_uri; content:"Authorization|3a| Bearer"; http_header; pcre:"/Bearer\s+[A-Za-z0-9]{1,10}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wekan: Update to version 18.16 or later. This is the only complete fix.
2. Restrict Access: If immediate upgrade is not possible, restrict network access to the Wekan API endpoint using a firewall or reverse proxy.
3. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests to /api/attachments with non-standard bearer tokens.

Long-Term Mitigations:

• Implement proper input validation and authentication checks for all API endpoints.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in the future.

Workaround (if patching is delayed):

• Disable the attachment upload feature temporarily by modifying the Wekan configuration or using a reverse proxy to block the /api/attachments endpoint.

Valters IT