Description

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-23T04:17:09.573Z",
  "pubdate": "2026-08-23T04:17:09.573Z",
  "executiveSummary": "A Server-Side Request Forgery vulnerability has been identified in vas3k TaxHacker up to 0.8.2 within the Email Sync component. Specifically, the flaw resides in the buildImapConfig function of the lib/email-sync/imap-client.ts file, where insufficient validation of the host and port arguments permits malicious manipulation.\nThis vulnerability enables remote attackers to induce the affected server into initiating arbitrary network connections, potentially targeting internal network resources or external services. The primary risk implication includes unauthorized exposure of internal application endpoints, service enumeration, and potential interaction with internal backend infrastructure that is otherwise inaccessible from the external network.\nExploitation of this vulnerability can be performed remotely without requiring pre-existing authentication or specialized privileges within the application. The attack vector relies entirely on supplying crafted input parameters to the vulnerable IMAP configuration builder, forcing the application to process malicious host and port values during the email synchronization routine.",
  "technicalDetails": "The vulnerability stems from inadequate input validation and sanitization within the buildImapConfig function located in lib/email-sync/imap-client.ts. The Email Sync component processes user-supplied or configuration-driven parameters representing the IMAP server host and port without enforcing strict allowlists, destination constraints, or proper URL and socket-level parsing.\nBecause the application dynamically constructs network connection parameters based on these unsanitized inputs, an attacker can manipulate the host and port arguments to point to arbitrary network destinations. When the component executes the IMAP connection sequence, the underlying runtime library attempts to establish a TCP connection to the attacker-specified address and port.\nThe attack flow proceeds as follows: First, the remote attacker identifies the input vector corresponding to the IMAP host and port settings within the TaxHacker application. Second, the attacker crafts a malicious payload substituting the legitimate IMAP server coordinates with a targeted internal IP address, loopback address, or cloud metadata service endpoint. Third, the attacker submits the payload to the vulnerable Email Sync component.\nUpon processing, the buildImapConfig function incorporates the manipulated host and port into the connection configuration object. The application subsequently attempts to connect to the arbitrary destination, thereby exposing the server to Server-Side Request Forgery.\nThe affected versions include vas3k TaxHacker up to 0.8.2. The vulnerability is network-exposed, allows remote exploitation, and does not require authentication or elevated privileges. Post-exploitation impact depends on the internal network topology, potentially allowing attackers to pivot, interact with internal microservices, or retrieve sensitive data from internal-only network services."
}