Taxhacker
Monthly
Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config.ts` falls back to a hard-coded value for `BETTER_AUTH_SECRET` when the environment variable is not explicitly set at deployment. Because TaxHacker is open-source on GitHub, the default secret is publicly readable, enabling any remote unauthenticated attacker to forge valid JWT tokens and impersonate arbitrary users - including administrators - against any misconfigured instance. No vendor patch exists; the maintainer had not responded to the disclosure issue at time of analysis, and publicly available exploit code is indicated by the CVSS 4.0 E:P flag.
Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the application server to initiate arbitrary IMAP TCP connections to attacker-controlled hosts and ports via the Email Sync configuration interface. The `buildImapConfig` function in `lib/email-sync/imap-client.ts` accepted unsanitized `host` and `port` parameters with no allowlist validation, no private-IP blocking, and no port restriction, allowing the TaxHacker server process to be redirected as a proxy into the internal network. No public exploit is identified at time of analysis; the upstream fix (PR #170) introduces a dedicated validation module but awaits merge acceptance and has not been released in a tagged version.
Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config.ts` falls back to a hard-coded value for `BETTER_AUTH_SECRET` when the environment variable is not explicitly set at deployment. Because TaxHacker is open-source on GitHub, the default secret is publicly readable, enabling any remote unauthenticated attacker to forge valid JWT tokens and impersonate arbitrary users - including administrators - against any misconfigured instance. No vendor patch exists; the maintainer had not responded to the disclosure issue at time of analysis, and publicly available exploit code is indicated by the CVSS 4.0 E:P flag.
Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the application server to initiate arbitrary IMAP TCP connections to attacker-controlled hosts and ports via the Email Sync configuration interface. The `buildImapConfig` function in `lib/email-sync/imap-client.ts` accepted unsanitized `host` and `port` parameters with no allowlist validation, no private-IP blocking, and no port restriction, allowing the TaxHacker server process to be redirected as a proxy into the internal network. No public exploit is identified at time of analysis; the upstream fix (PR #170) introduces a dedicated validation module but awaits merge acceptance and has not been released in a tagged version.