| tiêu đề | vas3k TaxHacker main Server-Side Request Forgery |
|---|
| Mô tả | The email sync feature of TaxHacker allows users to configure custom IMAP server host and port. In lib/email-sync/imap-client.ts:5-18, buildImapConfig() passes these user-controlled parameters directly to imap-simple, which establishes a TCP connection to the specified host and port. An attacker can configure a malicious IMAP server address through addEmailServerAction() and trigger SSRF.
Details:
In app/(app)/apps/email/actions.ts:20-50, addEmailServerAction() accepts user-controlled serverData including host and port without validation. The stored config is used by syncServer() in lib/email-sync/ingest.ts:38-48, calling client.fetchMessages(). Inside buildImapConfig() (lib/email-sync/imap-client.ts:5-18), user-provided host and port are directly used in the IMAP connection config. imaps.connect() at line 22 establishes a TCP connection to the attacker-specified host and port. testImapConnection() at line 60-67 also uses the same vulnerable function.
Core vulnerable code path:
- app/(app)/apps/email/actions.ts:20-35 - addEmailServerAction() accepts user-controlled host and port in serverData without validation
- lib/email-sync/imap-client.ts:5-18 - buildImapConfig() directly uses user-controlled host and port in IMAP connection config
- lib/email-sync/imap-client.ts:20-23 - imaps.connect() establishes TCP connection to attacker-specified host:port
POC:
Call addEmailServerAction with host='internal.service' and port=6379. Then call testEmailConnectionAction to trigger connection. Server makes TCP connection to internal.service:6379.
Impact:
SSRF via TCP connection enabling internal network scanning, service fingerprinting, and firewall bypass.
Remediation:
Restrict host to valid DNS names, block private IP ranges, limit ports to 143/993.
References:
https://github.com/vas3k/TaxHacker/issues/148
CWE: CWE-918 Server-Side Request Forgery
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A/N (Score: 7.5) |
|---|
| Nguồn | ⚠️ https://github.com/vas3k/TaxHacker/issues/148 |
|---|
| Người dùng | keyblue (UID 96875) |
|---|
| Đệ trình | 07/07/2026 03:14 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 22/08/2026 12:55 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 394301 [vas3k TaxHacker đến 0.8.2 Email Sync imap-client.ts buildImapConfig host/port nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|