Description

A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-20T17:16:52.557Z",
  "pubdate": "2026-09-20T17:16:52.557Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in vas3k TaxHacker up to version 0.8.5. The vulnerability resides within the Invoice PDF Renderer component.\nThe flaw allows remote, unauthenticated attackers to force the application to perform unauthorized requests to arbitrary internal or external resources by manipulating the businessLogo argument.\nThis vulnerability poses a significant security risk, as successful exploitation enables attackers to bypass network perimeters, probe internal services, or access sensitive data exposed on the local network or internal infrastructure.\nThe vulnerability is currently public, and no official vendor response or patch has been provided to date, heightening the risk of exploitation.",
  "technicalDetails": "The vulnerability is located in the generateInvoicePDF function within the /apps/invoices/actions.ts file. The root cause is the improper validation and sanitization of user-supplied input provided via the businessLogo argument during the PDF generation process.\nWhen the TaxHacker application processes an invoice generation request, it utilizes the businessLogo input to retrieve or process an image asset. Because the application fails to enforce strict allow-listing of domains or protocols, an attacker can supply a crafted URL pointing to internal infrastructure, local services, or metadata endpoints.\nThe attack flow begins when an attacker sends a crafted request to the endpoint responsible for invoking generateInvoicePDF. By injecting a malicious URI (e.g., internal loopback addresses or internal network identifiers) into the businessLogo parameter, the attacker forces the server-side component to initiate an outbound request using the server's credentials and network context.\nThe component, acting as a proxy, attempts to fetch the content from the provided URL. Because this request originates from the application server, it may bypass external firewalls or Access Control Lists (ACLs) that protect the internal network. The application then processes the response from the targeted resource, potentially incorporating it into the generated PDF or triggering side effects based on the response content.\nExploitation allows for several impact vectors: 1. Port scanning: The attacker can identify running services on the server's local network by analyzing response time variations or error messages. 2. Cloud Metadata Exfiltration: In cloud environments, the attacker may target the Instance Metadata Service (e.g., 169.254.169.254) to retrieve sensitive identity tokens or configuration data. 3. Internal Service Interaction: The attacker can communicate with internal-only APIs, microservices, or databases that do not require external authentication, potentially leading to unauthorized data exposure or administrative actions.\nGiven that the exploit is public and the vulnerability persists in affected versions without a formal security patch, the risk level is high. The vulnerability does not require prior authentication, making it reachable to any remote attacker with network access to the application instance."
}