CVE-2023-46245 Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

High 7.2 Published 31 Oct 2023 Updated 2 Aug 2024

Authenticated attackers can achieve remote code execution by uploading malicious Twig files in Kimai time-tracking application.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-46245?

CVE-2023-46245 is a high-severity code injection vulnerability in kimai, published on 31 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Kimai is a web-based multi-user time-tracking application. Versions prior to 2.1.0 are vulnerable to a Server-Side Template Injection (SSTI) which can be escalated to Remote Code Execution (RCE). The vulnerability arises when a malicious user uploads a specially crafted Twig file, exploiting the software's PDF and HTML rendering functionalities. Version 2.1.0 enables security measures for custom Twig templates.

Weakness: CWE-1336

Which versions are affected by CVE-2023-46245?

2 open source packages ship an affected version, including kimai/kimai. It affects 1 product.

Package	Affected	Fixed in
`kimai/kimai` Packagist	All versions	`2.1.0`
`kimai/kimai` Packagist	All versions	`2.1.0`

Products include Kimai Kimai.

How do I fix CVE-2023-46245?

Upgrade kimai/kimai to 2.1.0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-46245 being exploited?

There is no known exploitation of CVE-2023-46245 in the wild and no public exploit code.

Sources

Also known as GHSA-fjhg-96cp-6fcw.