An authenticated Server-Side Request Forgery vulnerability in InvoiceShelf versions prior to 2.2.0 poses a significant risk of internal network reconnaissance and unauthorized resource access.

The application fails to sanitize user-supplied HTML within the invoice Notes field before passing it to the Dompdf library. An attacker with administrative privileges can trigger this flaw via PDF preview or email delivery endpoints to force the server to fetch arbitrary remote resources.

The ability to perform SSRF allows an attacker to bypass perimeter defenses and interact with internal services that are not exposed to the public internet. Given the CVSS score of 7.6, this vulnerability represents a high risk: it could lead to the unauthorized disclosure of internal configuration data or metadata, potentially facilitating further exploitation of the internal infrastructure.

Immediate Action: Upgrade to InvoiceShelf version 2.2.0 or later immediately to apply the sanitization fix for the Dompdf integration.

Proactive Monitoring: Review web server access logs for unusual outbound requests originating from the application server, particularly those targeting internal IP addresses or sensitive cloud metadata endpoints.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal network segments and unauthorized external domains.

Public Exploit Available: No (Exploit status is unknown; no weaponized exploit or public proof-of-concept repository has been confirmed).

This vulnerability presents a high-severity risk due to the potential for internal network exposure. Administrators should prioritize updating to version 2.2.0 immediately to remediate the underlying flaw. If an immediate update is not feasible, restrict access to the invoice management modules to trusted personnel and implement egress filtering to mitigate the impact of potential SSRF attempts.