| शीर्षक | vas3k TaxHacker 0.8.5 Server-Side Request Forgery |
|---|
| विवरण | A vulnerability has been found in TaxHacker, an open-source personal AI accounting and tax assistant, up to version 0.8.5. The testLLMProviderAction Server Action (app/(app)/apps/settings/actions.ts) lacks any session validation, and all four parameters (provider, apiKey, model, baseUrl) are fully controlled by the client. An unauthenticated attacker can invoke it via the Next-Action header and, when provider is set to "openai_compatible", inject an arbitrary URL into the configuration.baseURL of the OpenAI client. The server then makes an HTTP POST request to the attacker-specified target, including internal addresses and cloud metadata endpoints. Both connection errors and the target's raw response body are reflected back in the error message, enabling internal network port scanning, reading internal HTTP service responses, and probing cloud instance metadata endpoints.
|
|---|
| स्रोत | ⚠️ https://github.com/vas3k/TaxHacker/issues/187 |
|---|
| उपयोगकर्ता | CAPT (UID 100253) |
|---|
| सबमिशन | 26/08/2026 10:44 AM (25 दिन पहले) |
|---|
| संयम | 19/09/2026 11:05 PM (25 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407969 [vas3k TaxHacker तक 0.8.5 actions.ts testLLMProviderAction provider/apiKey/model/baseUrl अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|