Team leads could move their own time records into another team member's account

1. Home
2. Security
3. Kimai Advisory

Affected versions

• Kimai versions >= 1.6.0 are affected by this security issue
• The issue has been fixed in Kimai 2.68.0
• Severity: Medium
• A CVE ID is requested, pending assignment

Description

A user who was made team lead of a team could use the API to hand one of their own time records over to another member of that team, even without the permission that normally allows working on other people’s timesheets. The receiving user ended up with a time record they never created, which can distort reports, budgets and invoices.

• The attacker needs an API account and the “team lead” flag on a team membership. This flag is set by an administrator when configuring teams; users can’t give it to themselves with the default permission setup.
• The attacker needs the create_own_timesheet and edit_own_timesheet permissions, which every normal user has. The create_other_timesheet and edit_other_timesheet permissions, which are meant to control working on other users’ timesheets, were not required.
• Only the API was affected, the frontend always used the correct permission checks.
• The target has to be a member of a team the attacker leads. Users outside those teams couldn’t be targeted, and the request was rejected for anyone without the team lead flag.
• The new record shows up in the receiving user’s timesheet and in everything built on it, such as reports, budgets and exports.
• The attacker loses access to the record as soon as it’s reassigned, so they can’t change or delete it afterwards.

Solution

The API now requires the edit_other_timesheet permission before the user field is accepted when updating a time record, which matches the web interface and the existing rule for creating records. Team leads with that permission can still reassign records inside their teams; everyone else gets a validation error and the record keeps its owner.

Users should update to 2.68.0 or newer.

Credits

• Reported by: devzephyr and euriconicacio
• Patched by: kevinpapst