GitHub Security Advisory: GHSA-jg2j-2w24-54cg
Package: kimai/kimai (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
Vulnerable versions: < 2.46.0
Patched in: 2.46.0

Summary: Kimai has an Authenticated Server-Side Template Injection (SSTI)

Details:
# Kimai 2.45.0 - Authenticated Server-Side Template Injection (SSTI)

## Vulnerability Summary

| Field | Value |
|-------|-------|
| **Title** | Authenticated SSTI via Permissive Export Template Sandbox || **Attack Vector** | Network |
| **Attack Complexity** | Low |
| **Privileges Required** | High (Admin with export permissions and server access) |
| **User Interaction** | None |
| **Impact** | Confidentiality: HIGH (Credential/Secret Extraction) |
| **Affected Versions** | Kimai 2.45.0 (likely earlier versions) |
| **Tested On** | Docker: kimai/kimai2:apache-2.45.0 |
| **Discovery Date** | 2026-01-05 |

---

**Why Scope is "Changed":** The extracted `APP_SECRET` can be used to forge Symfony login links for ANY user account, expanding the attack beyond the initially compromised admin context.

---

## Vulnerability Description

Kimai's export functionality uses a Twig sandbox with an overly permissive security policy (`DefaultPolicy`) that allows arbitrary method calls on objects available in the template context. An authenticated user with export permissions can deploy a malicious Twig template that extracts sensitive information including:

1. **Environment Variables** (APP_SECRET, DATABASE_URL)
2. **All User Password Hashes** (bcrypt)
3. **Serialized Session Tokens**
4. **CSRF Tokens**

---

## Prerequisites

1. **Authenticated Access**: Valid account with export permissions (typically ROLE_ADMIN, ROLE_SUPER_ADMIN, or ROLE_TEAMLEAD)
2. **Template Deployment**: Ability to place a malicious `.pdf.twig` template in `/opt/kimai/var/export/` via:
   - Filesystem access (server admin)

---

## Test Environment

### Users in Test Instance

The test environment contains 2 users whose password hashes were successfully extracted:

Kimai Users Page - screenshot_users.png:
<img width="1124" height="1119" alt="screenshot_users" src="https://github.com/user-attachments/assets/89771b84-a95c-4c6d-9515-7e9a38ef3235" />


| User | Role | Hash Extracted |
|------|------|----------------|
| admin | ROLE_SUPER_ADMIN | ✅ Yes |
| lowpriv | ROLE_USER | ✅ Yes |

---

## Confirmed Exploitation Evidence

### Test Date: 2026-01-05

### Extracted Data (Actual Output from Exploit)

```
===SSTI_EXTRACTION_START===

1. ENVIRONMENT VARIABLES
APP_SECRET: change_this_to_something_unique
DATABASE_URL: mysql://kimai:kimai@db:3306/kimai?charset=utf8mb4&serverVersion=8.0
APP_ENV: prod

2. SESSION TOKEN (SERIALIZED)
O:74:"Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken":3:{
  i:0;N;i:1;s:12:"secured_area";i:2;a:5:{
    i:0;O:15:"App\Entity\User":5:{
      s:2:"id";i:1;
      s:8:"username";s:5:"admin";
      s:7:"enabled";b:1;
      s:5:"email";s:17:"admin@example.com";
      s:8:"password";s:60:"$2y$13$MsbvH2KU4c..MKHvzLxXFOm2ifNeXM/5Lnpae82hz322kUuSGLgye";
    }
    i:1;b:1;i:2;N;i:3;a:0:{}
    i:4;a:2:{i:0;s:16:"ROLE_SUPER_ADMIN";i:1;s:9:"ROLE_USER";}
  }
}

3. CURRENT USER DETAILS
username: admin
email: admin@example.com
password_hash: $2y$13$MsbvH2