Taxhacker
Monthly
Server-side request forgery in vas3k TaxHacker up to and including 0.8.5 lets an attacker who can reach the LLM-provider configuration function force the server to issue requests to an arbitrary URL of their choosing. The flaw lives in the testLLMProviderAction server action in app/(app)/apps/settings/actions.ts, where the attacker-supplied baseUrl is used as the destination of an outbound HTTP request without validation; publicly available exploit code exists and the project has not responded to the reported issue. Independent assessment places the realistic severity lower than the vendor's CVSS 4.0 score of 5.5: because TaxHacker is a self-hosted, login-gated application, practical exploitation requires an authenticated session and a working LLM-configuration screen, and the achievable impact is limited to confidentiality (reading responses from internal endpoints the server can reach) rather than code execution or data modification.
Server-side request forgery in vas3k TaxHacker up to 0.8.5 lets an attacker control the businessLogo argument passed to the generateInvoicePDF function in /apps/invoices/actions.ts and force the server-side invoice PDF renderer to fetch an arbitrary URL. The independent assessment rates this as moderate severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with exploitation requiring an account on the self-hosted instance that can configure business branding and trigger invoice generation, rather than an anonymous internet attacker. Publicly available exploit code exists, the issue was reported to the project early via GitHub issue #186 without a vendor response, and no CISA KEV listing was identified - impact is limited to low confidentiality, integrity, and availability with no code execution.
Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config.ts` falls back to a hard-coded value for `BETTER_AUTH_SECRET` when the environment variable is not explicitly set at deployment. Because TaxHacker is open-source on GitHub, the default secret is publicly readable, enabling any remote unauthenticated attacker to forge valid JWT tokens and impersonate arbitrary users - including administrators - against any misconfigured instance. No vendor patch exists; the maintainer had not responded to the disclosure issue at time of analysis, and publicly available exploit code is indicated by the CVSS 4.0 E:P flag.
Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the application server to initiate arbitrary IMAP TCP connections to attacker-controlled hosts and ports via the Email Sync configuration interface. The `buildImapConfig` function in `lib/email-sync/imap-client.ts` accepted unsanitized `host` and `port` parameters with no allowlist validation, no private-IP blocking, and no port restriction, allowing the TaxHacker server process to be redirected as a proxy into the internal network. No public exploit is identified at time of analysis; the upstream fix (PR #170) introduces a dedicated validation module but awaits merge acceptance and has not been released in a tagged version.
Server-side request forgery in vas3k TaxHacker up to and including 0.8.5 lets an attacker who can reach the LLM-provider configuration function force the server to issue requests to an arbitrary URL of their choosing. The flaw lives in the testLLMProviderAction server action in app/(app)/apps/settings/actions.ts, where the attacker-supplied baseUrl is used as the destination of an outbound HTTP request without validation; publicly available exploit code exists and the project has not responded to the reported issue. Independent assessment places the realistic severity lower than the vendor's CVSS 4.0 score of 5.5: because TaxHacker is a self-hosted, login-gated application, practical exploitation requires an authenticated session and a working LLM-configuration screen, and the achievable impact is limited to confidentiality (reading responses from internal endpoints the server can reach) rather than code execution or data modification.
Server-side request forgery in vas3k TaxHacker up to 0.8.5 lets an attacker control the businessLogo argument passed to the generateInvoicePDF function in /apps/invoices/actions.ts and force the server-side invoice PDF renderer to fetch an arbitrary URL. The independent assessment rates this as moderate severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with exploitation requiring an account on the self-hosted instance that can configure business branding and trigger invoice generation, rather than an anonymous internet attacker. Publicly available exploit code exists, the issue was reported to the project early via GitHub issue #186 without a vendor response, and no CISA KEV listing was identified - impact is limited to low confidentiality, integrity, and availability with no code execution.
Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in `lib/config.ts` falls back to a hard-coded value for `BETTER_AUTH_SECRET` when the environment variable is not explicitly set at deployment. Because TaxHacker is open-source on GitHub, the default secret is publicly readable, enabling any remote unauthenticated attacker to forge valid JWT tokens and impersonate arbitrary users - including administrators - against any misconfigured instance. No vendor patch exists; the maintainer had not responded to the disclosure issue at time of analysis, and publicly available exploit code is indicated by the CVSS 4.0 E:P flag.
Server-side request forgery in vas3k TaxHacker up to version 0.8.2 enables authenticated remote attackers to force the application server to initiate arbitrary IMAP TCP connections to attacker-controlled hosts and ports via the Email Sync configuration interface. The `buildImapConfig` function in `lib/email-sync/imap-client.ts` accepted unsanitized `host` and `port` parameters with no allowlist validation, no private-IP blocking, and no port restriction, allowing the TaxHacker server process to be redirected as a proxy into the internal network. No public exploit is identified at time of analysis; the upstream fix (PR #170) introduces a dedicated validation module but awaits merge acceptance and has not been released in a tagged version.