Exploit for CVE-2026-49865 CVE-2026-49865 CVE-2026-52824

## https://sploitus.com/exploit?id=530E89E9-E25B-55F7-A1F8-E64A94274AEA
# Kimai CVE-2026-52824 — Default APP_SECRET Authentication Bypass

> **Note:** The repository URL contains an outdated CVE ID (CVE-2026-49865). The correct and current CVE tracked in this repository is **CVE-2026-52824** (GHSA-jr9p-4h4j-6c58).

Proof-of-concept exploit toolkit for the hardcoded default `APP_SECRET` vulnerability in Kimai time-tracking (versions ≤ 2.57.0). Allows authentication bypass via forged `KIMAI_REMEMBER` cookies on unpatched Docker deployments.

## Vulnerability Summary

| Field | Value |
|-------|-------|
| **CVE** | CVE-2026-52824 |
| **GHSA** | GHSA-jr9p-4h4j-6c58 |
| **CVSS** | 9.1 (Critical) |
| **CWE** | CWE-1188 — Insecure Default Resource Initialization |
| **Affected** | Kimai ≤ 2.57.0 (Docker image / `.env.dist`) |
| **Fixed** | 2.58.0 |
| **Credit** | Trent M. (`AzureADTrent`) |

## How It Works

Kimai ships with a hardcoded default `APP_SECRET` in its Docker image and `.env.dist`:

```
APP_SECRET=change_this_to_something_unique
```

In v2.57.0, the `signature_properties` for remember-me cookies is empty, making the `FieldsHash` a constant (`SHA256('')`). Combined with the known secret, anyone can forge a valid `KIMAI_REMEMBER` cookie for any user — including admin.

### Attack Chain

1. Identify a Kimai instance running ≤ 2.57.0
2. User IDs are sequential (admin = id:1)
3. Known `APP_SECRET` → compute HMAC-SHA256 signatures
4. Forge `KIMAI_REMEMBER` cookie with admin's user_id + username
5. Server validates HMAC → full admin session
6. Admin access enables timesheet manipulation, user creation, and potential RCE

### What Changed in v2.58.0

| Aspect | v2.57.0 (Vulnerable) | v2.58.0 (Patched) |
|--------|---------------------|-------------------|
| **Dockerfile** | `ENV APP_SECRET=change_this_to_something_unique` | No hardcoded default |
| **entrypoint.sh** | No secret generation | Generates `bin2hex(random_bytes(32))` on first boot |
| **Storage** | N/A | Persists in `/opt/kimai/var/data/.appsecret` |

## Toolkit Contents

| File | Purpose |
|------|---------|
| `exploit.py` | Single-target exploit — forges cookie and authenticates |
| `batch_pwn.py` | Multi-threaded batch exploitation against a list of hosts |
| `quick_scan.py` | Two-pass scanner — quick filter then deep probe |
| `deep_probe.py` | Version detection via multiple endpoints |
| `probe_batch.py` | Probe hosts from file for version + vulnerability |
| `shodan-scanner.py` | Shodan integration for discovering Kimai instances |

## Installation

```bash
git clone https://github.com/cyeezy08/Kimai-CVE-2026-49865-POC.git
cd Kimai-CVE-2026-49865-POC
pip install -r requirements.txt
```

## Usage

### Single Target Exploit

```bash
python3 exploit.py https://kimai.example.com
python3 exploit.py https://kimai.example.com admin --dump
```

### Batch Exploitation

```bash
# From a file of URLs
python3 batch_pwn.py kimai_hosts.txt results.txt 30
```

### Shodan Discovery

```bash
export SHODAN_API_KEY="your_key"
python3 shodan-scanner.py --search --output kimai_hosts.txt
```

### Version Probing

```bash
python3 deep_probe.py kimai_hosts.txt versioned_results.txt
python3 quick_scan.py hosts_file.txt
```

## Requirements

- Python 3.8+
- `requests` — HTTP client
- `shodan` — Shodan API client (only for `shodan-scanner.py`)

## Disclaimer

This toolkit is provided for **authorized security testing and research only**. Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing. The author assumes no liability for misuse.

## License

MIT