| 标题 | vas3k TaxHacker main Server-Side Request Forgery |
|---|
| 描述 | The email sync feature of TaxHacker allows users to configure custom IMAP server host and port. In lib/email-sync/imap-client.ts:5-18, buildImapConfig() passes these user-controlled parameters directly to imap-simple, which establishes a TCP connection to the specified host and port. An attacker can configure a malicious IMAP server address through addEmailServerAction() and trigger SSRF.
Details:
In app/(app)/apps/email/actions.ts:20-50, addEmailServerAction() accepts user-controlled serverData including host and port without validation. The stored config is used by syncServer() in lib/email-sync/ingest.ts:38-48, calling client.fetchMessages(). Inside buildImapConfig() (lib/email-sync/imap-client.ts:5-18), user-provided host and port are directly used in the IMAP connection config. imaps.connect() at line 22 establishes a TCP connection to the attacker-specified host and port. testImapConnection() at line 60-67 also uses the same vulnerable function.
Core vulnerable code path:
- app/(app)/apps/email/actions.ts:20-35 - addEmailServerAction() accepts user-controlled host and port in serverData without validation
- lib/email-sync/imap-client.ts:5-18 - buildImapConfig() directly uses user-controlled host and port in IMAP connection config
- lib/email-sync/imap-client.ts:20-23 - imaps.connect() establishes TCP connection to attacker-specified host:port
POC:
Call addEmailServerAction with host='internal.service' and port=6379. Then call testEmailConnectionAction to trigger connection. Server makes TCP connection to internal.service:6379.
Impact:
SSRF via TCP connection enabling internal network scanning, service fingerprinting, and firewall bypass.
Remediation:
Restrict host to valid DNS names, block private IP ranges, limit ports to 143/993.
References:
https://github.com/vas3k/TaxHacker/issues/148
CWE: CWE-918 Server-Side Request Forgery
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A/N (Score: 7.5) |
|---|
| 来源 | ⚠️ https://github.com/vas3k/TaxHacker/issues/148 |
|---|
| 用户 | keyblue (UID 96875) |
|---|
| 提交 | 2026-07-07 03時14分 (2 月前) |
|---|
| 管理 | 2026-08-22 12時55分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 394301 [vas3k TaxHacker 直到 0.8.2 Email Sync imap-client.ts buildImapConfig host/port 权限提升] |
|---|
| 积分 | 20 |
|---|