The predator attacked the 28-year-old man while he was surfing at around 8pm (AEDT) on Tuesday at North Avoca Beach.
The victim felt his arm go underneath the surfboard and immediately paddled back in to the beach to raise the alarm.
He sustained a 5cm puncture wound to his right forearm and another to his right wrist.
Paramedics treated him on the scene, and he was then taken to Gosford Hospital in a stable condition.
Rick Parsons, president of the North Avoca Surf Lifesaving Club, said witnesses had reported the shark being brown and about 1.8 metres long.
He said it could have been a bronze whaler, which was recently sighted at nearby Terrigal Beach.
But added the attack was extremely uncommon.
“I’ve never known of a shark attack on North Avoca and I’ve been involved with the surf club for the past 20 years,” he said.