Kanboard is project management software that focuses on the Kanban methodology. An authenticated Kanboard admin can run arbitrary php code on the server in combination with a file write possibility. The user interface language is determined and loaded by the setting `application_language` in the `settings` table. Thus, an attacker who can upload a modified sqlite.db through the dedicated feature, has control over the filepath, which is loaded. Exploiting this vulnerability has one constraint: the attacker must be able to place a file (called translations.php) on the system. However, this is not impossible, think of anonymous FTP server or another application that allows uploading files. Once the attacker has placed its file with the actual php code as the payload, the attacker can craft a sqlite db settings, which uses path traversal to point to the directory, where the `translations.php` file is stored. Then gaining code execution after importing the crafted sqlite.db. This issue has been addressed in version 1.2.42 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
The Kanboard application loads a language file (translations.php) based on the value of the application_language setting stored in the settings table of the SQLite database. An attacker with administrator privileges can upload a crafted sqlite.db database through the built-in import function, where the path to the language file contains path traversal sequences pointing to the location of a translations.php file controlled by the attacker. This file must be previously placed on the server by any available method — e.g., via an anonymous FTP server or another application that allows file uploads. After importing the crafted SQLite database, the application loads the substituted PHP file and executes the code contained in it.
An attacker gains the ability to execute arbitrary PHP code on the server (RCE), which can lead to complete system takeover, data theft, backdoor installation, or further lateral movement in the network.
Kanboard should be updated to version 1.2.42 or later. The vendor does not provide any workarounds for this vulnerability — the only effective remedial measure is to update.
Kanboard in all versions prior to 1.2.42. An administrator account and the ability to place a translations.php file on the server are required.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HKanboard
APPKanboard< 1.2.42
Related vulnerabilities
Kanboard: pominięcie uwierzytelnienia przez sfałszowany nagłówek HTTP (REVERSE_PROXY_AUTH)
Kanboard: niebezpieczna deserializacja PHP umożliwiająca RCE
Kanboard: path traversal umożliwiający odczyt i usunięcie plików przez admina
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite...
Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authen...