Description

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-20T17:16:52.730Z",
  "pubdate": "2026-09-20T17:16:52.730Z",
  "executiveSummary": "The vas3k TaxHacker application, specifically up to version 0.8.5, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. The flaw originates from improper input validation within the LLM configuration testing functionality.\nBy manipulating specific parameters including provider, apiKey, model, and baseUrl, a remote, unauthenticated attacker can force the server to initiate arbitrary network requests. This capability allows attackers to interact with internal services, query metadata APIs (such as those used in cloud environments), or bypass network access control lists (ACLs) to probe private infrastructure.\nGiven that the exploit is publicly disclosed and the vendor has not yet addressed the report, the risk to operational security is critical. The vulnerability allows for blind or reflected SSRF, which can be leveraged to gain unauthorized visibility into internal network architecture or facilitate further exploitation of backend systems.",
  "technicalDetails": "The vulnerability resides within the function testLLMProviderAction located in app/(app)/apps/settings/actions.ts. This function is responsible for validating LLM provider configurations by sending an outbound request using the parameters provided by the user via the application interface.\nThe root cause is the lack of server-side sanitization and allow-listing for the input parameters, specifically the 'baseUrl'. The application takes these user-supplied inputs and uses them to construct a network request without validating if the destination URI is pointing toward external, untrusted infrastructure versus internal, sensitive resources.\nThe attack flow follows a predictable pattern: 1) The attacker navigates to the settings interface that invokes testLLMProviderAction. 2) The attacker intercepts the request or directly interacts with the application API to supply malicious values into the 'provider', 'apiKey', 'model', or 'baseUrl' fields. 3) By injecting an internal IP address or a loopback address (e.g., http://127.0.0.1 or http://169.254.169.254) into the 'baseUrl' parameter, the attacker forces the server to execute an HTTP request to an internal target.\nBecause the function performs the request on behalf of the server, the server effectively acts as a proxy for the attacker. If the environment is cloud-hosted, this could be used to query instance metadata services to retrieve sensitive credentials or environment variables. Furthermore, the attacker can use this mechanism to perform port scanning of internal network segments that are otherwise inaccessible from the public internet.\nThe vulnerability is critical as it bypasses traditional perimeter security, leveraging the server's own networking stack to perform reconnaissance or unauthorized interactions. No authentication is strictly required for this exploit if the settings endpoint is exposed or reachable. The impact is significant, potentially leading to full internal information disclosure, lateral movement within the network, or unauthorized actions performed against internal APIs.\nThe exploit is currently publicly available, increasing the likelihood of automated exploitation attempts. Until a patch is issued, the application should be considered compromised if exposed to untrusted users."
}