CVE-2023-46245: Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
Summary
CVE-2023-46245: Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File. Affects kimai/kimai versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kimai is an open-source time-tracking software designed for businesses and individuals to manage and monitor their work hours. It provides features such as invoicing, project management, and reporting. The vulnerability in the latest version of Kimai allows authenticated users to exploit a Server-Side Template Injection (SSTI) vulnerability, which can be escalated to Remote Code Execution (RCE). This vulnerability occurs when a malicious user uploads a specially crafted Twig file, taking advantage of the software's PDF and HTML rendering functionalities.
Vulnerability Detail
The vulnerability arises when the software attempts to render invoices, allowing the attacker to execute arbitrary code on the server. By uploading a malicious Twig file containing a payload, the attacker can trigger the SSTI vulnerability. When the invoices are downloaded, the malicious code gets executed, leading to RCE. As a result, the attacker gains unauthorized access to the server and can perform various malicious activities.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
composer require kimai/kimai:2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is essential to apply the official patch or update the software to the latest secure version as soon as it is available.
Conclusion
The vulnerability in Kimai allows authenticated users to exploit a Server-Side Template Injection (SSTI) vulnerability, leading to Remote Code Execution (RCE). It is crucial to update to a patched version of Kimai and follow secure coding practices to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for kimai/kimai →
FAQ
Kimai is an open-source time-tracking software used for managing work hours, invoicing, project management, and reporting.
Server-Side Template Injection (SSTI) is a vulnerability that allows an attacker to inject and execute arbitrary code on the server by exploiting insecure template rendering mechanisms.
The vulnerability in Kimai occurs when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. This allows the attacker to execute arbitrary code on the server.
Remote Code Execution (RCE) is a vulnerability that allows an attacker to execute arbitrary code on a target system remotely, gaining unauthorized access and control over the system.
To protect your Kimai installation, it is crucial to update to the latest secure version as soon as it is available. Regularly check for updates and apply them promptly. Additionally, follow secure coding practices and implement input validation and sanitization to prevent similar vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for kimai/kimai.
