5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2019-25317

CVE-2019-25317: Kimai 2- persistent cross-site scripting (XSS)

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2019-25317

CVE-2019-25317:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
kimai/kimai	composer	< 1.1	1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because user-supplied descriptions for timesheets were rendered as HTML without proper sanitization, allowing for persistent cross-site scripting (XSS). The analysis of the patch commit a0e8aa3a435717187fb12210242dab1b7c97ff3f reveals the root cause. The function App\Twig\MarkdownExtension::markdownToHtml was using a markdown-to-HTML converter with a setting that allowed raw HTML to be processed. This function was called by App\Twig\MarkdownExtension::timesheetContent, which is registered as the desc2html filter in the Twig templating engine. Multiple Twig templates used this filter to render the timesheet description ({{ entry.description|desc2html }}). An attacker could save a malicious payload (like an SVG with embedded JavaScript) in a timesheet description, which would then be executed in the browser of any user viewing that timesheet. The fix involves two parts: first, changing the markdownToHtml function to disallow raw HTML, and second, adding the escape filter in the Twig templates ({{ entry.description|escape|desc2html }}) as an additional layer of defense.

Vulnerable functions

App\Twig\MarkdownExtension::markdownToHtml

src/Twig/MarkdownExtension.php

The function `markdownToHtml` was used to convert markdown descriptions to HTML. The underlying markdown parser was configured to allow raw HTML (`->toHtml($content, true)`), which permitted attackers to inject malicious scripts (e.g., SVG-based XSS payloads) into timesheet descriptions. The patch changes this behavior by disallowing raw HTML (`->toHtml($content, false)`).

App\Twig\MarkdownExtension::timesheetContent

src/Twig/MarkdownExtension.php

This function is exposed to Twig templates as the `desc2html` filter. It takes the user-provided timesheet description and passes it directly to the vulnerable `markdownToHtml` function without any prior sanitization. While the function itself was not modified in the patch, it is the direct entry point for the untrusted data into the vulnerable rendering process.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.