Kimai has an XXE Leading to Local File Read
SummaryKimai uses [PHPSpreadsheet](https://github.com/PHPOffice/PhpSpreadsheet) for importing and exporting invoices. Recently, a [CVE](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7) was identified in PHPSpreadsheet, which could lead to an XXE vulnerability.DetailsExploitation requires an Administrator account, allowing the upload of an `XLSX` template containing the payload. The vulnerability is triggered by the following code snippet:The `IOFactory::load` function utilizes `simplexml_load_string`, which has previously been demonstrated to be vulnerable to XXE attacks.While this is not directly an XXE in Kimai, it does however impact the latest stable version.PoCBy uploading a malicious `XLSX` template, the payload will be triggered every time an invoice is generated.For a better a visibility, I will upload both a:Malicious template sample for testingAn exported invoice, showing the contents of target file during the export.ImpactLocal File Read / RCE in edge cases where `phar://` can be utilized with [gadget chains](https://github.com/ambionics/phpggc) .[export.xlsx](https://github.com/user-attachments/files/16803913/export.xlsx)
[sample_template.xlsx](https://github.com/user-attachments/files/16803916/sample_template.xlsx)