CVE-2021-43515 Improper Neutralization of Formula Elements in a CSV File in Kimai 2
Attackers can execute arbitrary code on victims' machines by injecting malicious formulas into the timesheet description field, which triggers when the data is exported to CSV.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-43515?
CVE-2021-43515 is a high-severity vulnerability in n/a, published on 8 Apr 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in creating new timesheet in Kimai. By filling the Description field with malicious payload, it will be mistreated while exporting to a CSV file.
Weakness: CWE-1236
Which versions are affected by CVE-2021-43515?
2 open source packages ship an affected version, including kevinpapst/kimai2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kevinpapst/kimai2 Packagist | All versions | 1.14.1 |
kevinpapst/kimai2 Packagist | All versions | 1.14.1 |
Products include Kimai Kimai.
How do I fix CVE-2021-43515?
Upgrade kevinpapst/kimai2 to 1.14.1 or later.
Is CVE-2021-43515 being exploited?
There is no known exploitation of CVE-2021-43515 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-19825 Cross-site Scripting in kimai/kimai
- CVE-2023-53957 Kimai 1.30.10 SameSite Cookie Vulnerability Session Hijacking
- CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File
- CVE-2026-23626 Kimai Vulnerable to Authenticated Server-Side Template Injection (SSTI)
- CVE-2024-29200 API returns timesheet entries a user should not be authorized to view
Sources
Also known as GHSA-64fq-9c6w-rq44.