A Server-Side Request Forgery vulnerability in InvoiceShelf versions prior to 2.2.0 poses a significant risk of unauthorized internal network interaction and data exposure.

The application fails to sanitize user-supplied HTML within the payment notes field, which is subsequently processed by the Dompdf library. This allows an authenticated administrator to trigger unauthorized outbound requests from the server environment to arbitrary network resources.

Successful exploitation of this vulnerability could allow an attacker to perform internal port scanning, bypass network firewalls, or access sensitive metadata services within the hosting environment. Given the CVSS score of 7.6, this represents a high-severity risk that could lead to lateral movement or the unauthorized disclosure of internal infrastructure information.

Immediate Action: Upgrade the InvoiceShelf installation to version 2.2.0 or later to ensure the sanitization of input passed to the PDF rendering engine.

Proactive Monitoring: Review web server and application access logs for unusual outbound requests originating from the server, particularly those targeting internal IP addresses or local services.

Compensating Controls: If an immediate patch cannot be applied, restrict the server from initiating outbound network connections to internal segments or sensitive endpoints using host-level firewall rules or egress filtering.

Public Exploit Available: Unknown.

The presence of a proof-of-concept and the nature of the SSRF vulnerability necessitate prompt action. Security teams should prioritize updating to version 2.2.0 to eliminate the underlying flaw in the PDF generation module. Until the update is deployed, ensure that the application server is isolated from sensitive internal assets to mitigate potential lateral movement.