Kimai has an XXE Leading to Local File Read
Date: 2024-09
Affected: composer/kimai/kimai
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-45048
CWE: CWE-1395
CWE-611
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)

### Summary Kimai uses [PHPSpreadsheet](https://github.com/PHPOffice/PhpSpreadsheet) for importing and exporting invoices. Recently, a [CVE](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7) was identified in PHPSpreadsheet, which could lead to an XXE vulnerability. ### Details Exploitation requires an Administrator account, allowing the upload of an `XLSX` template containing the payload. The vulnerability is triggered by the following code snippet: ```php // https://github.com/kimai/kimai/blob/b1903ba18359be16dd32ea9c40377c486498f082/src/Invoice/Renderer/AbstractSpreadsheetRenderer.php#L41 public function render(InvoiceDocument $document, InvoiceModel $model): Response { $spreadsheet = IOFactory::load($document->getFilename()); $worksheet = $spreadsheet->getActiveSheet(); $entries = $model->getCalculator()->getEntries(); $sheetReplacer = $model->toArray(); $invoiceItemCount = \count($entries); if ($invoiceItemCount > 1) { $this->addTemplateRows($worksheet, $invoiceItemCount); } } ``` The `IOFactory::load` function utilizes `simplexml_load_string`, which has previously been demonstrated to be vulnerable to XXE attacks. While this is not directly an XXE in Kimai, it does however impact the latest stable version. ### PoC By uploading a malicious `XLSX` template, the payload will be triggered every time an invoice is generated. ```xml <?xml version="1.0" encoding='UTF-7' standalone="yes"?> +ADw-!D


Mitigations:

Architectural layers (MAESTRO):