Executive brief
Invoice Ninja is a web-based invoicing and expense management application. A vulnerability in its PDF rendering engine allows authenticated attackers to embed malicious links in invoice notes that the server will fetch during PDF generation. This could expose internal network resources, cloud metadata services, or administrative interfaces that should not be accessible from the internet.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the Purify::isHostSafe() validation routine within app/Services/Pdf/Purify.php. The application validates hostnames in invoice notes using string-based blacklist checks for localhost, private IP ranges, and suspicious patterns, but fails to resolve hostnames to their actual IP addresses before allowing requests. An authenticated attacker can embed references to attacker-controlled domains that resolve to internal or restricted network addresses. When the server-side Chromium PDF renderer processes the invoice, it fetches these resources directly from the server infrastructure, enabling SSRF. Exploitation requires authentication and the ability to create or edit invoices.
Affected products
- Invoice Ninja Invoice Ninja up to 5.13.26
Timeline
- 2026-06: disclosed: Vulnerability discovered
- 2026-06-08: advisory: Vendor notified via responsible disclosure
- 2026-09-01: disclosed: Public disclosure via advisory and researcher writeup