Kimai (Authenticated) SSTI to RCE by Uploading a Malicious Twig File

CVE-2023-46245

What is CVE-2023-46245?

Kimai, a popular web-based multi-user time-tracking application, has a vulnerability that allows for Server-Side Template Injection (SSTI). This issue notably affects versions 2.1.0 and prior, enabling malicious users to upload specifically crafted Twig files that exploit the application's PDF and HTML rendering capabilities. If successfully executed, this could lead to Remote Code Execution (RCE), allowing attackers to gain control over the affected system. As of the latest information, there are no patches or known workarounds available, highlighting the urgent need for users to assess their vulnerability and take protective measures.

References