Server-Side Request Forgery in vas3k TaxHacker Invoice PDF Renderer

Executive Summary

This is a Server-Side Request Forgery (SSRF) and local file read vulnerability in the TaxHacker application up to version 0.8.5. The issue is in the generateInvoicePDF function which does not validate or sanitize the businessLogo field. An attacker can send a crafted request with a businessLogo pointing to a local file path like /etc/passwd or an internal URL such as http://127.0.0.1:8080/admin. The application processes these requests, allowing file reads or internal service probing. The official Docker image runs as root, increasing the risk.

Useful 0 Not Useful 0

Detection Guidance

To detect this SSRF and local file read vulnerability, monitor network traffic for unauthenticated POST requests to /apps/invoices/actions.ts with a crafted businessLogo parameter. Check application logs for requests containing file paths like /etc/passwd or internal URLs such as http://127.0.0.1:8080/admin. Use tools like curl to test if the endpoint processes arbitrary businessLogo values without authentication.

• Test with: curl -X POST http://<target>/apps/invoices/actions.ts -d '{"businessLogo":"/etc/passwd"}' to check for local file reads.
• Monitor for internal network probes or unexpected outbound requests from the TaxHacker application.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read sensitive local files on the server such as /etc/passwd or configuration files. They could also probe internal services running on localhost or the internal network, potentially discovering other services or gaining unauthorized access. Since the Docker container runs as root, the impact could be severe if the attacker gains control of the container or underlying host.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive financial and personal data stored in the application, violating GDPR and HIPAA requirements for data confidentiality and integrity. A breach could result in regulatory fines, loss of customer trust, and legal consequences due to unauthorized data exposure or modification.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the generateInvoicePDF action by adding authentication middleware. Validate and sanitize the businessLogo parameter to only accept trusted URLs or file paths. Update to the latest version if available or apply patches from the vendor. Consider running the application with reduced privileges instead of root.

• Block unauthenticated POST requests to /apps/invoices/actions.ts at the network level.
• Restrict outbound network access from the TaxHacker container to prevent SSRF attacks.

Useful 0 Not Useful 0