Invoice Ninja Authenticated Server-Side Request Forgery Vulnerability Allowing Arbitrary File Read and Network Resource Requests

A server-side request forgery (SSRF) vulnerability has been identified in Invoice Ninja versions 5.8.56 prior to 5.11.23. This vulnerability allows authenticated users to make arbitrary file read requests and access network resources on behalf of the application user.

Impact

Exploitation of this vulnerability could lead to unauthorized access to internal files and services, potentially allowing for further attacks or data exposure.

Reproduction

To reproduce this vulnerability, an authenticated user can send a request that exploits the SSRF flaw. This can be done by manipulating the application's request handling to read arbitrary files or access network resources.

Remediation

Users can update to Invoice Ninja version 5.11.23 or later, where this vulnerability has been fixed.