Description

Snipe-IT versions before 8.7.0 fail to HTML-escape the employee_num field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML() function. Attackers can craft a malicious employee_num value containing an img tag with an arbitrary HTTP(S) URL to trigger server-side requests to internal services, cloud metadata endpoints, or external targets when a victim signs an asset acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-09T14:17:27.740Z",
  "pubdate": "2026-09-09T14:17:27.740Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Snipe-IT versions prior to 8.7.0 due to improper input sanitization within the asset acceptance PDF generation feature. An attacker with 'users.edit' permissions can inject malicious HTML tags into the 'employee_num' field, which are subsequently rendered by the TCPDF library. This vulnerability allows an authenticated attacker to force the Snipe-IT server to initiate arbitrary outbound HTTP(S) requests. The impact includes the potential for internal network reconnaissance, interaction with cloud provider metadata services (e.g., IMDS), and unauthorized scanning of internal services restricted to the server's network segment. Exploitation is contingent upon the attacker possessing the ability to modify user attributes, specifically the employee number, and triggering the acceptance PDF generation process. Given the server-side nature of the request, this bypasses client-side firewalls and leverages the server's identity or network position to access protected resources, representing a significant risk to the integrity and confidentiality of the internal infrastructure.",
  "technicalDetails": "The vulnerability resides in the interaction between the application's user input handling and the TCPDF library's writeHTML() function. Snipe-IT fails to perform necessary HTML-escaping on the 'employee_num' field before passing it to the PDF generation engine. When a user with 'users.edit' permissions modifies an employee's profile to include a malicious payload, such as an <img> tag with an arbitrary src URL, the application stores this unsanitized string in the database.\nThe exploitation flow initiates when a victim signs an asset acceptance, triggering the generation of a PDF document that includes the employee's details. During the rendering process, the TCPDF library's writeHTML() function parses the stored 'employee_num'. Because the tag is not escaped, the library attempts to resolve and fetch the content specified in the image source URL. This execution happens on the server side, utilizing the server's network context to perform the HTTP(S) request.\nThis behavior facilitates a classic SSRF attack vector. By supplying a crafted URI, an attacker can coerce the server into performing a GET request against internal network resources that are otherwise inaccessible to the public. In cloud-hosted environments, this is particularly dangerous as it allows for the exfiltration of sensitive configuration data or temporary security credentials from metadata endpoints (e.g., 169.254.169.254). Furthermore, the attacker can use the server as a proxy to probe port availability on internal services, facilitating reconnaissance of the internal topology. The attack does not require direct access to the target service by the attacker; rather, the attacker relies on the server's ability to reach these endpoints as a trusted actor within the internal network segment.\nThe scope of this vulnerability is limited to authenticated users with specific 'users.edit' permissions, which restricts the threat actor profile to authorized system users or those who have compromised an account with such privileges. The payload behavior is limited to what the TCPDF library can interpret within its rendering context, primarily focusing on triggering outbound network requests via URI resolution."
}