• Javascript saved to field is run when page is reloaded
• Affected Wekan v3.12-v4.11
• Fixed at Wekan v4.12 2020-06-08

1. Add a new card
2. Put the name: <img src=x onerror=alert(1)>
3. The payload is saved and executed everytime the page is loaded

[Urgent] XSS in any boards

Summary

A Stored XSS can be performed in any board by adding an IFRAME XSS Payload as a List name.

Steps to Reproduce

1. In account A (User) create a new board and add a new list with the payload <iframe/src=javascript:alert(document.cookie)>
2. Archive or delete the List (an attacker can do this to hide the swimlane)
3. Request account B (Admin/User) to be added to the board
4. Accept the request from account

Explanation

The XSS happens since the payload is being rendered in the Activity tab.

Impact

An XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies, perform requests in the name of the victim or for phishing attacks.

Supporting Material

I am not familiar with Node.js, therefore I cannot provide the solution code. But it is clear here, the rendered arbitrary code in the activity session causes this XSS. Therefore, the input has to be sanitized to prevent XSS.

I hope I have written a clear report. If there are any questions or doubts, feel free to contact me. I'll be happy to clarify more.

Best,
Sajeth Jonathan

-----------------------------------------------------------------
Vulnerability report JVN#80785288 (begins here)
-----------------------------------------------------------------
This vulnerability was found and reported by the following
person, who would like to be credited when this issue is
published on both the developer's website and JVN.

  Name: Ryoya Koyama at Mitsui Bussan Secure Directions, Inc. (https://www.mbsd.jp/) 

- Vulnerability ID: JVN#80785288

- Type of Vulnerability: CWE-79 (XSS, cross-site scripting)

  actually the report explains Stored XSS.

- Affected Product and its version(s): Wekan v3.94 and v3.95

  the reporter built a verification environment using docker-compose.yml
  and verified the vulnerability on 2020/04/13.

- Reproduction Steps:

    * prerequisites

      - Attacker needs to login to Wekan.
      - Victim needs to be able to access Wekan,
        either logged in to Wekan or not.

    * Attack Scenario

      - Attacker log in to Wekan, and creates Board, List, Card.

      - Attacker attach a malicious SVG file to the created Card.
        (see test.svg)
        this attached file is accessible with the URL like this:

        http://localhost/cfs/files/attachments/hCxhmMyekCFjLJowB/test.svg?token=eyJhdXRoVG9rZW4iOiJsbmtZMi1mN1dSNjFPMTRjS3JzMmx3WlBzRlN3RzloQU9TOWxmZ0dXVWFfIn0%3D&download=true

        note that the URL above contains "download" parameter, but
        the URL without "download" parameter works too.

      - Attacker leads Victim to the URL without "download" parameter.

        http://localhost/cfs/files/attachments/hCxhmMyekCFjLJowB/test.svg?token=eyJhdXRoVG9rZW4iOiJsbmtZMi1mN1dSNjFPMTRjS3JzMmx3WlBzRlN3RzloQU9TOWxmZ0dXVWFfIn0%3D

      - accessing the URL without "download" parameter, the attached file is
        treated "inline" on Victim's web browser, which means
        the javascript code inside the file is executed on the web browser.
        (see alert.png for the screenshot when the javascript code is executed,
         and log.txt for the http request and response.)

    * Additional information
       - when "download" parameter exists in the requested URL, then
         the response comes with
         Content-Disposition: attachment; filename="test.svg"

       - when "download" parameter is missing, the response comes with
         Content-Disposition: inline

       - Content-Type of the response depends on the file type;
         when the file type is either txt, xml, html, pdf, then
             Content-Type: application/octet-stream
         when the file type is svg, then
             Content-Type: image/svg+xml

         any modern web browsers do not open
         "application/octet-stream" contents inline, hence
         the reporter demonstrates the attack with svg file.

- Possible Impact:

    - Confidentiality
      Cookie information may be leaked, which can be utilized
      to execute some actions by the attacker

    - Integrity
      page contents may be modified, enabling phishing

    - Availability
      None

    - Initial CVSS evaluation
    CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/BS:5.4


- Comments from JPCERT/CC

    Sorry to notify this report to you very lately.
    We received this report on May 2020, but
    missed to handle it in timely manner.
    Quick looking at CHANGELOG.md and CVE Hall of Fame,
    I don't find any mentions on xss-related fixes.
    We don't verify the report on the latest Wekan version by our selves,
    but suppose this report still has a value for you.

-----------------------------------------------------------------
Vulnerability report JVN#80785288 (ends here)
-----------------------------------------------------------------

PoC: content of test.svg file

From maintainer of Wekan, xet7:

From maintainer of Wekan, xet7: