BillForge — SSRF Chain via Chromium PDF Invoice Generation

hackadvisor

Task: Invoicing platform (BillForge) with headless Chromium PDF export where notes field exhibits differential rendering — HTML escaped in web view but rendered raw in PDF. Solution: 3-step SSRF chain — injected HTML/JS in notes to discover internal config service (port 3001), extracted vault credentials from config, then used JavaScript fetch() with X-Service-Key header to access vault secrets (port 3002) and retrieve the flag.