CVE-2023-46245

Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.

Affected

kimai

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

1.47% chance of exploitation in the next 30 days, 73rd percentile

Published

2023-10-31

Updated

2024-08-02

Proof-of-concept exploits (1)

• kimai/kimai/security/advisories/GHSA-fjhg-96cp-6fcw

Security advisories

• advisories/GHSA-fjhg-96cp-6fcw

References

• CVE Record
• NVD entry