Description

A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-01T05:17:10.803Z",
  "pubdate": "2026-09-01T05:17:10.803Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Invoice Ninja versions up to 5.13.26.\nThe flaw resides within the application's PDF generation service, specifically triggered via the invoices endpoint.\nBy manipulating the 'notes' argument, an unauthenticated or remote attacker can force the server to initiate unauthorized outbound requests to arbitrary internal or external network resources.\nThis vulnerability poses a significant risk as it allows attackers to bypass perimeter security, probe internal network infrastructure, access sensitive metadata services (e.g., cloud instance metadata), or interact with services restricted to the local network interface.\nThe vulnerability is remotely exploitable and has been publicly disclosed, necessitating immediate attention to prevent potential exploitation by malicious actors.\nThe vendor has not provided a direct response or patch regarding this specific vulnerability disclosure.",
  "technicalDetails": "The vulnerability is located in the file app/Services/Pdf/Purify.php, specifically within the Purify::isHostSafe function.\nThe root cause of the SSRF lies in an insufficient validation mechanism within the logic responsible for filtering or sanitizing hostnames during PDF generation processes triggered by the invoices endpoint.\nWhen a user submits an invoice, the 'notes' field can be populated with malicious data that is subsequently processed by the application's PDF generation backend.\nThe Purify::isHostSafe function fails to adequately restrict the destination of requests initiated by the server, allowing the input to influence the target URL that the server-side component attempts to fetch or render.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious request containing a crafted URL within the 'notes' field of an invoice. 2) The application, processing the PDF creation request, triggers the internal PDF rendering engine. 3) The rendering engine, influenced by the malicious 'notes' content, passes the data to the vulnerable Purify::isHostSafe function, which fails to identify the URI as malicious. 4) The server performs an outbound HTTP/HTTPS request to the attacker-controlled URI or an internal target specified by the attacker.\nBecause the server initiates the request on behalf of the application, it effectively acts as a proxy, allowing the attacker to bypass firewall restrictions and interact with services reachable from the server's network segment.\nThe exploitation does not require advanced authentication or high-level privileges in some configurations, significantly lowering the barrier to entry for remote attackers.\nPost-exploitation impact includes the ability to perform port scanning on internal infrastructure, potential exfiltration of local system information, and in cloud environments, unauthorized access to IMDS (Instance Metadata Service) to retrieve sensitive configuration data or IAM credentials.\nThe vulnerability remains present in all versions up to and including 5.13.26, as the validation logic does not correctly implement blocklisting or allowlisting of safe protocols and hostnames."
}