PT-2024-40087 · Kimai+1 · Kimai+1

Published 2024-09-17 · Updated 2024-09-17

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Kimai versions (affected versions not specified) PHPSpreadsheet versions (affected versions not specified)

Description: The issue is related to an XXE vulnerability in PHPSpreadsheet, which is used by Kimai for importing and exporting invoices. Exploitation requires an Administrator account and the upload of a malicious XLSX template containing the payload. The vulnerability is triggered by the IOFactory::load function, which utilizes simplexml load string, previously demonstrated to be vulnerable to XXE attacks. This can lead to Local File Read or RCE in edge cases where phar:// can be utilized with gadget chains.

Recommendations: As a temporary workaround, consider disabling the upload of XLSX templates until a patch is available. Restrict access to the invoice generation feature to minimize the risk of exploitation. Avoid using the IOFactory::load function with untrusted input until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-1395

CWE-611

Related Identifiers

GHSA-534C-HCR7-67JG

Affected Products

Kimai

Phpspreadsheet

References · 5

• https://osv.dev/vulnerability/GHSA-534c-hcr7-67jg · Vendor Advisory
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7 · Note
• https://github.com/kimai/kimai · Note
• https://github.com/kimai/kimai/security/advisories/GHSA-534c-hcr7-67jg · Note
• https://github.com/kimai/kimai/commit/3204dcb03e1003dba90178667a4667ce3edb87b5 · Note