CyberRota Analysis
AI-GeneratedWekan's webhook integration feature prior to version 9.32 is vulnerable due to improper validation of user-input URLs, allowing board administrators to configure malicious webhook URLs that can trigger server-side requests to internal services. This could lead to unauthorized access to sensitive internal data or services. Organizations using Wekan, particularly those with sensitive internal networks, should prioritize updating to version 9.32 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fetched by server/notifications/outgoing.js without applying the existing validateAttachmentUrl() private-network checks from models/lib/attachmentUrlValidation.js. A board administrator can configure webhook URLs that cause server-side requests to internal or metadata services. This issue is fixed in version 9.32.