vas3k TaxHacker vulnerabilities

A server-side request forgery vulnerability was detected in vas3k TaxHacker up to 0.8.5 in the generateInvoicePDF function of /apps/invoices/actions.ts in the Invoice PDF Renderer component. Manipulation of the businessLogo argument results in server-side request forgery, and the attack can be carried out remotely. The exploit is public and may be used, and the project has not responded to the issue report.

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.