GHSA-g82g-m9vx-vhjg Kimai has Stored XSS via Incomplete HTML Attribute Escaping in Team Member Widget

• Packagist kimai/kimai: < 2.53.0 → fixed in 2.53.0

Summary The client-side `escapeForHtml()` function in `KimaiEscape.js`, introduced in commit `89bfa82c` (#2959) to fix a JavaScript XSS vulnerability, only escapes ``, and `&` but does not escape `"` (double quote) or `'` (single quote). When user-controlled data (profile alias) is placed in an HTML attribute context (`title="__DISPLAY__"`) via the team member form prototype and rendered through `innerHTML`, the missing quote escaping allows HTML attribute injection, resulting in Stored XSS. Details Incomplete security patch. The `escapeForHtml()` function was meant to prevent XSS but missed quote characters, which are critical for HTML attribute context escaping. Vulnerable code — `assets/js/plugins/KimaiEscape.js:29-33`: ```javascript const tagsToReplace = { '&': '&amp;', '': '&gt;', // MISSING: '"': '&quot;' // MISSING: "'": '&#039;' }; ``` Affected code files: • `assets/js/plugins/KimaiEscape.js:24-38` — incomplete escape function • `assets/js/forms/KimaiTeamForm.js:77,86` — replacement + innerHTML • `templates/macros/widgets.html.twig:126` — `title="{{ tooltip }}"` in avatar macro • `templates/form/blocks.html.twig:104` — `{{ widgets.avatar('__INITIALS__', '__COLOR__', '__DISPLAY__') }}` PoC poc.zip Please extract the uploaded compressed file before proceeding 1. ./setup.sh 2. ./poc_xss.sh Impact • Stored XSS: payload persists in the database (user alias field) • Privilege escalation: ROLE_USER injects XSS that executes in ROLE_ADMIN/ROLE_SUPER_ADMIN browser session