CVE-2026-29925: Invoice Ninja SSRF Vulnerability

CVE-2026-29925 Overview

Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php. This vulnerability allows an authenticated attacker to make arbitrary HTTP requests from the server, potentially accessing internal services, cloud metadata endpoints, or other protected resources that should not be directly accessible from the internet.

Critical Impact

An authenticated attacker can leverage this SSRF vulnerability to access internal network resources, potentially exfiltrating sensitive data from cloud metadata services, internal APIs, or other backend systems not exposed to the public internet.

Affected Products

• Invoice Ninja v5.12.46
• Invoice Ninja v5.12.48

Discovery Timeline

• 2026-03-30 - CVE CVE-2026-29925 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-29925

Vulnerability Analysis

This Server-Side Request Forgery (SSRF) vulnerability exists within the CheckDatabaseRequest.php file of Invoice Ninja v5. The vulnerability stems from insufficient validation of user-supplied input that is used to construct server-side HTTP requests. When the application processes database connection check requests, it fails to properly sanitize or restrict the target URLs, allowing an authenticated user to redirect server-side requests to arbitrary destinations.

The scope of this vulnerability extends beyond the vulnerable system itself, enabling attackers to pivot and access resources on the internal network or interact with cloud provider metadata services. This cross-scope impact is particularly concerning in cloud-hosted deployments where metadata endpoints (such as 169.254.169.254) could expose sensitive credentials and configuration data.

Root Cause

The root cause of this vulnerability is improper input validation in the CheckDatabaseRequest.php request handler. The application accepts user-controlled input for database connection parameters without adequately validating or restricting the target host addresses. This allows attackers to specify internal IP addresses, localhost references, or cloud metadata endpoints as connection targets, which the server will then attempt to reach on behalf of the attacker.

Attack Vector

The attack is conducted over the network and requires low-privileged authenticated access to the Invoice Ninja application. An attacker with valid credentials can craft malicious requests to the database check functionality, substituting legitimate database connection parameters with URLs pointing to internal resources.

The attacker can target:

• Internal network services (e.g., http://192.168.1.x/admin)
• Cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/)
• Localhost services (e.g., http://127.0.0.1:6379/ for Redis)
• Internal APIs and microservices

This can result in unauthorized access to sensitive internal data, credential theft from cloud metadata services, or reconnaissance of internal network topology.

For technical details and proof-of-concept information, refer to the GitHub Gist documentation. The vulnerable code can be reviewed in the Invoice Ninja CheckDatabaseRequest.php file.

Detection Methods for CVE-2026-29925

Indicators of Compromise

• Unusual outbound requests from the Invoice Ninja server to internal IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
• HTTP requests to cloud metadata endpoints (169.254.169.254) originating from the application server
• Anomalous database connection check requests with non-standard hostnames or IP addresses
• Server logs showing connection attempts to localhost services on unexpected ports

Detection Strategies

• Monitor application logs for requests to CheckDatabaseRequest.php containing suspicious host parameters
• Implement network-level monitoring to detect outbound connections from the Invoice Ninja server to internal IP ranges
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF patterns in request parameters
• Enable SentinelOne Singularity Platform for behavioral analysis of unexpected network connections from web application processes

Monitoring Recommendations

• Configure alerting for any outbound connections from the web server to RFC1918 private IP addresses
• Monitor for requests to common cloud metadata IP addresses (169.254.169.254, 169.254.170.2)
• Implement logging and alerting on all database connection validation requests
• Review access logs for authenticated users making repeated requests to the setup/database check endpoints

How to Mitigate CVE-2026-29925

Immediate Actions Required

• Upgrade Invoice Ninja to a patched version beyond v5.12.48 when available from the vendor
• Implement network segmentation to restrict outbound connections from the Invoice Ninja server
• Configure firewall rules to block outbound requests to internal IP ranges and cloud metadata endpoints from the application server
• Review and audit recent access logs for signs of exploitation attempts

Patch Information

No official patch information has been published by the vendor at this time. Organizations should monitor the Invoice Ninja GitHub repository for security updates and releases addressing this SSRF vulnerability. Until a patch is available, implementing the workarounds below is strongly recommended.

Workarounds

• Restrict access to the setup and database check functionality to trusted administrative IP addresses only
• Implement a Web Application Firewall (WAF) rule to block requests containing internal IP addresses or metadata endpoints in request parameters
• Use network-level controls to prevent the web server from initiating connections to internal network ranges
• Consider disabling or removing the database check functionality if not required for ongoing operations

# Example iptables rules to block SSRF attempts to internal networks and metadata endpoints
# Block requests to cloud metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP

# Block requests to internal RFC1918 ranges from web server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP

# Allow localhost but block SSRF to localhost services on non-standard ports
# (Implement application-specific rules as needed)