CVE-2026-34367: InvoiceShelf SSRF Vulnerability

CVE-2026-34367 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in InvoiceShelf, an open-source web and mobile application designed for tracking expenses, payments, and creating professional invoices and estimates. The vulnerability exists in the Invoice PDF generation module, where user-supplied HTML in the invoice Notes field is passed unsanitized to the Dompdf rendering library. This allows attackers to craft malicious invoice content that forces the server to fetch arbitrary remote resources, potentially exposing internal network infrastructure and sensitive data.

Critical Impact

Authenticated attackers with invoice creation privileges can leverage this SSRF vulnerability to access internal services, cloud metadata endpoints, and potentially exfiltrate sensitive information from the server's network context.

Affected Products

• InvoiceShelf versions prior to 2.2.0

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-34367 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34367

Vulnerability Analysis

This SSRF vulnerability (CWE-918) stems from insufficient input validation in InvoiceShelf's PDF generation workflow. When users create or edit invoices, the Notes field accepts HTML content that is subsequently processed by the Dompdf library for PDF rendering. Dompdf, by design, fetches remote resources referenced in the HTML markup such as images, stylesheets, and fonts. Without proper sanitization of user input, this behavior can be exploited to make the server issue outbound HTTP requests to attacker-controlled destinations or internal network resources.

The vulnerability can be triggered through two distinct pathways: the PDF preview functionality and the email delivery endpoint. Both pathways process the invoice content and invoke Dompdf rendering, making them susceptible to SSRF attacks.

Root Cause

The root cause is the lack of input sanitization for user-supplied HTML content in the invoice Notes field before passing it to the Dompdf rendering library. Dompdf's default configuration allows fetching of remote resources, and without proper validation or URL whitelisting, arbitrary network requests can be initiated from the server context.

Attack Vector

This vulnerability is exploitable over the network by authenticated users with high-level privileges (invoice creation capabilities). An attacker can inject malicious HTML tags such as <img>, <link>, or <iframe> referencing internal URLs, cloud provider metadata endpoints (e.g., http://169.254.169.254/), or external attacker-controlled servers. When the PDF preview is triggered or an invoice email is sent, the server fetches these resources, potentially leaking internal information or allowing reconnaissance of internal network topology.

The attack can result in information disclosure from internal services that would otherwise be inaccessible from external networks. The scope is changed as the vulnerability affects resources beyond the vulnerable component itself, allowing access to internal infrastructure.

Detection Methods for CVE-2026-34367

Indicators of Compromise

• Unusual outbound HTTP requests originating from the InvoiceShelf application server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Server-side requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
• Invoice Notes fields containing suspicious HTML tags with src or href attributes pointing to non-standard URLs
• Unexpected network connections from the web server process to local services (e.g., localhost ports, internal APIs)

Detection Strategies

• Monitor outbound network traffic from application servers for connections to internal IP ranges and cloud metadata services
• Implement web application firewall (WAF) rules to detect HTML injection patterns in invoice-related API endpoints
• Review application logs for PDF generation errors or timeouts that may indicate failed SSRF attempts
• Deploy network segmentation monitoring to detect lateral movement attempts from web application tiers

Monitoring Recommendations

• Enable detailed logging for the Dompdf rendering process including all resource fetch attempts
• Set up alerting for outbound requests from the InvoiceShelf server to RFC 1918 private address spaces
• Monitor invoice creation and PDF generation endpoints for anomalous request patterns
• Implement network-level visibility to track DNS queries originating from the application server

How to Mitigate CVE-2026-34367

Immediate Actions Required

• Upgrade InvoiceShelf to version 2.2.0 or later immediately
• Review all existing invoices for suspicious HTML content in Notes fields
• Implement network egress filtering to restrict outbound connections from the application server
• Consider disabling PDF email delivery functionality until the patch is applied

Patch Information

InvoiceShelf has released version 2.2.0 which addresses this SSRF vulnerability. The patch implements proper sanitization of user-supplied HTML content before processing by the Dompdf library. Administrators should upgrade immediately by following the official release notes available in the GitHub Release 2.2.0. Additional technical details about the vulnerability can be found in the GitHub Security Advisory GHSA-q9wx-ggwq-mcgh.

Workarounds

• Configure Dompdf to disable remote resource fetching by setting isRemoteEnabled to false in the library configuration
• Implement a strict Content Security Policy to restrict resource loading origins
• Deploy network-level controls to block outbound requests from the application server to internal networks and cloud metadata endpoints
• Use a reverse proxy or WAF to sanitize HTML input before it reaches the application

# Example: Restrict outbound connections using iptables
# Block access to cloud metadata endpoints
iptables -A OUTPUT -d 169.254.169.254 -j DROP
# Block access to internal network ranges (adjust as needed)
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP