CVE-2021-43515
📋 TL;DR
CVE-2021-43515 is a CSV injection vulnerability in Kimai time tracking software that allows attackers to inject malicious formulas into exported CSV files. When users open these files in spreadsheet applications like Excel, the formulas can execute arbitrary commands or access external resources. This affects all Kimai users who export timesheet data to CSV format.
💻 Affected Systems
- Kimai
📦 What is this software?
Kimai by Kimai
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution on victim's machine when malicious CSV is opened in vulnerable spreadsheet software, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Data exfiltration via formula-based requests to attacker-controlled servers, or local file access through spreadsheet macro execution.
If Mitigated
Limited impact with proper user awareness training and spreadsheet security settings preventing automatic formula execution.
🎯 Exploit Status
Exploit requires authenticated access to create timesheets; CSV injection techniques are well-documented and easy to implement.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit dad1b8b772947f1596175add1b4f33b791705507
Vendor Advisory: https://github.com/kevinpapst/kimai2/commit/dad1b8b772947f1596175add1b4f33b791705507
Restart Required: No
Instructions:
1. Update Kimai to latest version or apply commit dad1b8b772947f1596175add1b4f33b791705507
2. Verify timesheet export functionality properly escapes formula characters
3. No service restart required for web application
🔧 Temporary Workarounds
Input Sanitization
allAdd custom validation to escape formula characters (=, +, -, @) in timesheet description field
Modify Kimai source to escape CSV formula characters before export
Export Format Restriction
allDisable CSV export or require additional approval for timesheet exports
Configure Kimai to disable CSV export functionality
🧯 If You Can't Patch
- Implement web application firewall rules to block formula characters in timesheet descriptions
- Train users to never open CSV files directly in spreadsheet applications; use text editors or import with data-only settings
🔍 How to Verify
Check if Vulnerable:
Create timesheet with description containing '=HYPERLINK("http://malicious.com")' and export to CSV. Open in Excel - if link executes, system is vulnerable.Check Version:
Check Kimai version via web interface or git log for commit dad1b8b772947f1596175add1b4f33b791705507Verify Fix Applied:
Repeat vulnerable test - formula characters should be escaped or prefixed with apostrophe in exported CSV.📡 Detection & Monitoring
Log Indicators:
- Multiple CSV exports from single user
- Timesheet descriptions containing formula characters (=, +, -, @)
Network Indicators:
- Outbound connections from spreadsheet applications to unusual domains after CSV opens
SIEM Query:
source="kimai" AND (description="=*" OR description="+*" OR description="-*" OR description="@*")🔗 References
- https://github.com/kevinpapst/kimai2/commit/dad1b8b772947f1596175add1b4f33b791705507#diff-6774f5865dbaf8bc6c55b75bd92e6f9950ebe7834aa2efd828a19fd637e667cf
- https://github.com/kevinpapst/kimai2/commit/dad1b8b772947f1596175add1b4f33b791705507#diff-6774f5865dbaf8bc6c55b75bd92e6f9950ebe7834aa2efd828a19fd637e667cf
