| タイトル | akaunting 3.1.21 Server-Side Request Forgery |
|---|
| 説明 | SSRF in Invoice PDF Rendering via Unsanitized Notes HTML + Dompdf Remote Fetch Enabled
Product: Akaunting 3.1.21
Vulnerability Type: Server-Side Request Forgery (SSRF)
The invoice PDF generation process in Akaunting renders user-controlled Notes field as raw, unsanitized HTML and passes it directly to Dompdf. Because remote URL fetching is enabled by default in Dompdf (enable_remote => true), an authenticated user with permission to create or edit invoices can inject arbitrary external resource tags (e.g., <img src="http://attacker-controlled-url">, <link>, <script>, etc.).
When the PDF is generated, the server makes an outbound HTTP request to the attacker-specified URL. This allows full Server-Side Request Forgery (SSRF), enabling the attacker to:
Probe internal network services (internal IP addresses, Docker containers, cloud metadata endpoints, etc.).
Access sensitive internal resources that are not reachable from the internet.
Potentially chain the SSRF with other vulnerabilities (e.g., local file read via file:// if allowed, or further exploitation of internal services). |
|---|
| ソース | ⚠️ https://drive.google.com/file/d/1zC8gMYeIfZi3CsK6RXBQINU_mllXH_6n/view?usp=drive_link |
|---|
| ユーザー | hai271120 (UID 96497) |
|---|
| 送信 | 2026年04月09日 14:17 (6 月 ago) |
|---|
| モデレーション | 2026年05月08日 21:54 (29 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 362345 [Akaunting 3.1.21 Invoice PDF Rendering config/dompdf.php 特権昇格] |
|---|
| ポイント | 20 |
|---|