Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.
When the REVERSE_PROXY_AUTH feature is enabled, the Kanboard application trusts HTTP headers passed in the request and uses them to identify the user. The problem is that the application does not verify whether the request actually comes from a trusted reverse proxy. An attacker can therefore send an HTTP request directly with an arbitrarily crafted header pointing to a selected user (e.g., an administrator) and gain full access to their account.
A remote attacker, without authentication, can assume the identity of any system user — including an administrator — gaining full access to project data and the ability to modify or delete it.
Kanboard should be updated to version 1.2.49, where the vulnerability has been fixed. As a temporary workaround, consider disabling the REVERSE_PROXY_AUTH option until the update is deployed, and restrict application access exclusively from trusted IP addresses at the firewall level.
Kanboard in versions 1.2.48 and earlier when the REVERSE_PROXY_AUTH option is enabled.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NKanboard
APPKanboard< 1.2.49
Related vulnerabilities
Kanboard: niebezpieczna deserializacja PHP umożliwiająca RCE
Kanboard: RCE przez path traversal w imporcie bazy SQLite
Kanboard: path traversal umożliwiający odczyt i usunięcie plików przez admina
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite...
Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authen...