CVE-2026-29925 Overview
CVE-2026-29925 is a Server-Side Request Forgery (SSRF) vulnerability in Invoice Ninja, an open-source invoicing and billing platform. The flaw resides in the CheckDatabaseRequest.php component and affects Invoice Ninja v5.12.46 and v5.12.48. An authenticated attacker with low privileges can abuse the database check request to send crafted HTTP requests from the application server to arbitrary internal or external destinations. This category of weakness is tracked as [CWE-918].
Critical Impact
A low-privileged attacker can pivot through the Invoice Ninja server to reach internal services, cloud metadata endpoints, and other resources that should not be exposed externally.
Affected Products
- Invoice Ninja v5.12.46
- Invoice Ninja v5.12.48
- CheckDatabaseRequest.php handler in the Setup HTTP request stack
Discovery Timeline
- 2026-03-30 - CVE-2026-29925 published to NVD
- 2026-04-02 - Last updated in NVD database
Technical Details for CVE-2026-29925
Vulnerability Analysis
The vulnerability exists in the CheckDatabaseRequest.php request handler used during database connectivity validation in Invoice Ninja. The handler accepts user-supplied connection parameters and performs outbound network connectivity from the application server. Because input is not restricted to safe destinations, an attacker can substitute internal IP ranges, loopback addresses, or cloud metadata hostnames. The server then issues the request on the attacker's behalf and may return responses or behavioral signals that reveal internal infrastructure. Confidentiality impact is high while integrity and availability remain unaffected, and the scope changes because the application acts as a proxy into trusted network zones.
Root Cause
The root cause is missing validation and allow-listing of destination hosts in the database check workflow. The application trusts user-controlled host and port values without enforcing network egress restrictions or blocking private address ranges, link-local addresses, and metadata service endpoints such as 169.254.169.254.
Attack Vector
Exploitation requires network access to the Invoice Ninja application and a valid low-privileged account. The attacker submits a crafted request to the database check endpoint with target hostnames or IPs pointing to internal services. The server-side process initiates the outbound connection, enabling reconnaissance of internal HTTP services, cloud instance metadata theft, and bypass of perimeter firewall controls. No verified public exploit code is available at this time. Refer to the GitHub Gist Example Code and the upstream GitHub Invoice Ninja Request File for source-level context.
Detection Methods for CVE-2026-29925
Indicators of Compromise
- Outbound HTTP requests from the Invoice Ninja application server to RFC1918 ranges, loopback, or 169.254.169.254 cloud metadata endpoints.
- Unexpected POST requests to setup or database check routes such as /setup/check_db originating from authenticated low-privileged sessions.
- Application logs containing database connection attempts to non-database ports (80, 443, 8080) or non-standard hostnames.
Detection Strategies
- Inspect web server access logs for repeated calls to setup-related endpoints handled by CheckDatabaseRequest.php after deployment.
- Correlate egress proxy or NetFlow telemetry with the Invoice Ninja host to identify anomalous internal connection attempts.
- Alert on any application-originated traffic to cloud instance metadata services, which legitimate invoicing logic should never contact.
Monitoring Recommendations
- Forward Invoice Ninja application and web server logs to a centralized analytics platform and retain HTTP request bodies where compliant.
- Implement egress monitoring on the host running Invoice Ninja and baseline expected outbound destinations.
- Track failed and successful authentication events tied to setup or admin routes to detect privilege misuse.
How to Mitigate CVE-2026-29925
Immediate Actions Required
- Upgrade Invoice Ninja to a fixed release published after v5.12.48 once the vendor publishes a patched version.
- Restrict access to setup and database check routes to administrators only and block them at the reverse proxy when not needed.
- Apply egress firewall rules on the Invoice Ninja host to deny traffic to RFC1918, loopback, and cloud metadata addresses.
Patch Information
No vendor advisory URL is listed in the NVD record at publication. Monitor the Invoice Ninja repository for updates to CheckDatabaseRequest.php that add host validation and block internal destinations.
Workarounds
- Place the Invoice Ninja server in a network segment with strict egress filtering that denies access to internal management interfaces and metadata services.
- Require IMDSv2 with hop-limit controls on AWS instances hosting Invoice Ninja to mitigate metadata theft via SSRF.
- Disable or password-gate the setup workflow in production deployments where database configuration changes are not required.
# Example egress restriction using iptables on the Invoice Ninja host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
