Executive brief
Pentestify, a penetration testing reporting tool, contains a vulnerability in its PDF export feature. An authenticated user can provide a malicious web link in the 'finding images' or 'client logo' fields, which causes the server to automatically visit that link when generating a report. This could allow an attacker to probe internal network services or cloud metadata that are not normally accessible from the outside.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Pentestify's PDF generation logic (backend/main.py). The application uses a headless Chromium browser (Playwright) to render reports into PDFs. Because the 'finding images' and 'report client_logo' fields in the input schemas (backend/schemas.py) lack URL validation, an authenticated attacker can inject arbitrary URLs. When the server-side browser renders the report, it fetches these URLs to satisfy <img> tags, allowing the attacker to trigger GET requests to internal loopback addresses, cloud metadata services, or external hosts. The issue was addressed in version 1.1.0 by restricting these fields to data URLs and sanitizing inputs.
Affected products
- maalfer Pentestify before 1.1.0
Timeline
- 2026-06-23: patched: Fix committed in version 1.1.0
- 2026-07-31: disclosed: CVE published by Secur0 CNA