Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.8epss 0.4%
exploitation probability
0.4%top 68% of all CVEs
observed exploitation
nono source reports it
In short
Kimai's export feature allows authenticated users to inject malicious code through templates, potentially exposing sensitive data like passwords and environment variables. This happens because the security restrictions on template processing are too loose.
Technical detail
Kimai versions prior to 2.46.0 use Twig templates with DefaultPolicy sandbox that permits unrestricted method invocation on template context objects. Authenticated users with export permissions can craft malicious Twig templates to access and exfiltrate environment variables, password hashes, session tokens, and CSRF tokens via Server-Side Template Injection (SSTI).
Summary generated and translated by AI from the official description.
Kimai is a web-based multi-user time-tracking application. Prior to version 2.46.0, Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including environment variables, all user password hashes, serialized session tokens, and CSRF tokens. Version 2.46.0 patches this issue.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected products
kimai · kimai