Invoice Ninja v5 is affected by a Server-Side Request Forgery vulnerability that allows authenticated attackers to perform unauthorized requests from the application server.

The application is susceptible to Server-Side Request Forgery (SSRF) within the CheckDatabaseRequest.php file. This flaw requires the attacker to be authenticated with low privileges to trigger the request.

Successful exploitation of this vulnerability allows an attacker to conduct SSRF attacks, potentially leading to unauthorized interaction with internal network services or cloud metadata endpoints. With a CVSS score of 7.7, this is a High severity issue that could facilitate lateral movement or the exposure of sensitive internal configuration data, posing a significant risk to the integrity of the internal infrastructure.

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official Invoice Ninja repository for security updates and apply them as soon as they are released.

Proactive Monitoring: Security teams should review application access logs for suspicious outbound requests originating from the web server, particularly those targeting internal IP addresses or sensitive local services.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to unauthorized internal network segments and utilize a Web Application Firewall to block requests containing anomalous parameters targeting database setup endpoints.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's gist referenced in the enrichment data.

Given the High severity of this vulnerability and the availability of a public proof-of-concept, users should treat this as a priority. Administrators must track vendor communications closely and apply the forthcoming security patches immediately upon availability to prevent potential exploitation.