CVE-2026-34365: InvoiceShelf SSRF Vulnerability

CVE-2026-34365 Overview

CVE-2026-34365 is a Server-Side Request Forgery (SSRF) vulnerability affecting InvoiceShelf, an open-source web and mobile application used for tracking expenses, payments, and creating professional invoices and estimates. The vulnerability exists in the Estimate PDF generation module where user-supplied HTML in the estimate Notes field is passed unsanitized to the Dompdf rendering library, allowing attackers to force the server to fetch arbitrary remote resources.

Critical Impact

Attackers with high-level privileges can exploit this SSRF vulnerability to access internal network resources, potentially leading to sensitive data exposure, internal service enumeration, and cross-boundary attacks affecting other systems.

Affected Products

• InvoiceShelf versions prior to 2.2.0
• InvoiceShelf Estimate PDF generation module
• Systems using Dompdf rendering library through InvoiceShelf

Discovery Timeline

• 2026-03-31 - CVE-2026-34365 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34365

Vulnerability Analysis

This SSRF vulnerability (CWE-918) affects the PDF generation functionality within InvoiceShelf's estimate module. The core issue stems from insufficient input sanitization when processing HTML content in the estimate Notes field. When a user with appropriate privileges creates or modifies an estimate, they can inject arbitrary HTML markup containing references to external resources.

The Dompdf library, which handles the HTML-to-PDF conversion, processes these resource references and attempts to fetch them from the server side. This behavior can be leveraged to force the InvoiceShelf server to make requests to arbitrary internal or external URLs, effectively turning the application into a proxy for malicious requests.

The vulnerability is particularly concerning because it can be exploited through multiple attack surfaces: directly via the PDF preview endpoint and through customer view endpoints. Notably, the exploitation does not depend on whether automated email attachment features are enabled, broadening the attack surface considerably.

Root Cause

The root cause of this vulnerability lies in the lack of input sanitization for user-controlled HTML content before it is passed to the Dompdf rendering library. The application fails to validate, sanitize, or restrict the types of resources that can be referenced in the HTML markup within the estimate Notes field.

Dompdf, by design, fetches remote resources referenced in HTML content (such as images, stylesheets, or other external assets) to properly render the PDF document. Without proper input validation and resource loading restrictions, this behavior becomes exploitable for SSRF attacks.

Attack Vector

The attack vector is network-based and requires high-level privileges to exploit. An attacker with access to create or modify estimates can:

1. Insert malicious HTML content into the estimate Notes field containing references to internal network resources
2. Trigger PDF generation through the preview or customer view endpoints
3. The server-side Dompdf library fetches the referenced resources, making requests on behalf of the attacker
4. The attacker can potentially access internal services, enumerate internal network infrastructure, or exfiltrate data through DNS or HTTP-based channels

This vulnerability enables attackers to bypass network segmentation and access internal resources that would otherwise be inaccessible from external networks. The scope is changed (S:C in CVSS), meaning the vulnerability can affect resources beyond the vulnerable component's security scope.

Detection Methods for CVE-2026-34365

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests originating from the InvoiceShelf application server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• PDF generation requests containing HTML tags with suspicious external resource references in estimate Notes fields
• DNS lookups for unusual internal hostnames or metadata service endpoints (e.g., 169.254.169.254) from the web server
• Unexpected network connections to cloud metadata services or internal infrastructure

Detection Strategies

• Monitor web application logs for estimate creation/modification requests containing HTML markup with <img>, <link>, <iframe>, or similar tags referencing internal resources
• Implement network monitoring to detect outbound connections from the InvoiceShelf server to internal network ranges or restricted endpoints
• Review Dompdf logs for resource fetching errors or timeouts that may indicate SSRF probing attempts
• Deploy web application firewall (WAF) rules to detect and block HTML injection patterns in estimate-related endpoints

Monitoring Recommendations

• Enable detailed logging for all PDF generation operations including the raw content being rendered
• Configure alerts for network traffic from web servers to internal services not typically accessed during normal operations
• Monitor for requests to cloud provider metadata endpoints (AWS IMDSv1/v2, Azure IMDS, GCP metadata server) from application servers
• Implement egress filtering and log all outbound connections from the InvoiceShelf application tier

How to Mitigate CVE-2026-34365

Immediate Actions Required

• Upgrade InvoiceShelf to version 2.2.0 or later immediately
• If immediate upgrade is not possible, disable or restrict access to the PDF generation functionality
• Review recent estimate entries for suspicious HTML content that may indicate attempted exploitation
• Implement network egress controls to restrict the InvoiceShelf server from accessing internal resources

Patch Information

The vulnerability has been patched in InvoiceShelf version 2.2.0. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed patch information, refer to the GitHub Release 2.2.0 and the GitHub Security Advisory GHSA-pc5v-8xwc-v9xq.

Workarounds

• Implement input validation to strip or encode HTML tags from the estimate Notes field before PDF rendering
• Configure Dompdf to disable remote resource fetching by setting appropriate options (e.g., isRemoteEnabled to false)
• Deploy network-level controls to prevent the web server from accessing internal network ranges
• Restrict access to PDF preview and customer view endpoints to trusted users only until the patch can be applied

# Configuration example - Network egress restrictions using iptables
# Block outbound connections from web server to internal networks
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j DROP