InvoiceShelf versions prior to 2.2.0 are vulnerable to Server-Side Request Forgery (SSRF) in the PDF generation module, posing a significant risk of unauthorized internal network interaction.

The application fails to sanitize user-supplied HTML within the estimate Notes field before passing it to the Dompdf rendering library. This allows an authenticated user with high privileges to trigger requests to arbitrary remote resources through the PDF preview and customer view endpoints.

The exploitation of this SSRF vulnerability could allow an attacker to bypass perimeter security controls, potentially leading to the discovery of internal network topology or interaction with non-public services. Given the CVSS score of 7.6, this represents a high-severity risk that could facilitate further lateral movement or data exfiltration within the organization, directly impacting the confidentiality and integrity of the internal network infrastructure.

Immediate Action: Upgrade the InvoiceShelf installation to version 2.2.0 or later, which includes the necessary sanitization logic to prevent the processing of malicious remote resource references.

Proactive Monitoring: Review application access logs for unusual requests directed at internal IP addresses or sensitive local endpoints originating from the web server.

Compensating Controls: Implement strict egress filtering on the web server to restrict outbound network connections to only known, required external endpoints, thereby limiting the impact of any potential SSRF attempt.

Public Exploit Available: No (exploit_available: unknown)

The risk posed by this SSRF vulnerability is significant for organizations hosting InvoiceShelf on internal infrastructure. Security teams should prioritize the update to version 2.2.0 immediately to eliminate the vulnerable code path. Failure to patch may allow attackers to leverage the server as a proxy to probe internal systems, necessitating swift remediation to maintain a secure posture.