CVE-2019-25317
📋 TL;DR
Kimai 2 contains a persistent cross-site scripting (XSS) vulnerability that allows attackers to inject malicious SVG scripts into timesheet descriptions. When other users view these manipulated timesheets, arbitrary JavaScript executes in their browsers. This affects all Kimai 2 instances with vulnerable versions.
💻 Affected Systems
- Kimai 2
📦 What is this software?
Kimai by Kimai
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed in the context of authenticated users.
If Mitigated
Limited impact with proper input validation and output encoding, though some data integrity issues may persist.
🎯 Exploit Status
Exploitation requires authenticated access to create/modify timesheets. Public exploit code exists in Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3 and later
Vendor Advisory: https://github.com/kevinpapst/kimai2/pull/962
Restart Required: No
Instructions:
1. Update Kimai 2 to version 1.3 or later. 2. Run database migrations if required. 3. Clear application cache.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side filtering to sanitize SVG content in timesheet descriptions
Implement custom validation in TimesheetController.php to strip SVG tags
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SVG-based XSS payloads
- Restrict timesheet creation/modification permissions to trusted users only
🔍 How to Verify
Check if Vulnerable:
Check Kimai version via admin panel or composer.json. Versions below 1.3 are vulnerable.Check Version:
php bin/console kimai:versionVerify Fix Applied:
Test by attempting to insert SVG with script tags in timesheet description - should be sanitized or rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual timesheet modifications
- Multiple failed XSS attempts in web logs
Network Indicators:
- Unexpected external requests from Kimai server
SIEM Query:
source="kimai.log" AND ("svg" OR "script" OR "onload")