CVE-2025-55150
📋 TL;DR
CVE-2025-55150 is a Server-Side Request Forgery (SSRF) vulnerability in Stirling-PDF's HTML-to-PDF conversion endpoint. Attackers can bypass security sanitization to make unauthorized requests to internal systems. This affects all Stirling-PDF instances prior to version 1.1.0 that have the vulnerable endpoint exposed.
💻 Affected Systems
- Stirling-PDF
📦 What is this software?
Stirling Pdf by Stirlingpdf
⚠️ Risk & Real-World Impact
Worst Case
Full internal network compromise allowing attackers to access sensitive internal services, exfiltrate data, or pivot to other systems.
Likely Case
Information disclosure from internal services, potential data exfiltration, and reconnaissance of internal network infrastructure.
If Mitigated
Limited impact with proper network segmentation and egress filtering, potentially only revealing internal service banners.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited. The advisory suggests the bypass is straightforward once discovered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0
Vendor Advisory: https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xw8v-9mfm-g2pm
Restart Required: Yes
Instructions:
1. Stop Stirling-PDF service. 2. Update to version 1.1.0 or later. 3. Restart the service. For Docker: docker pull frooodle/s-pdf:latest && docker-compose up -d
🔧 Temporary Workarounds
Disable HTML-to-PDF endpoint
allTemporarily disable the vulnerable /api/v1/convert/html/pdf endpoint
Modify configuration to remove or restrict access to the endpoint
Network segmentation
allIsolate Stirling-PDF from sensitive internal networks
Configure firewall rules to restrict outbound connections from Stirling-PDF
🧯 If You Can't Patch
- Implement strict network egress filtering to limit outbound connections from Stirling-PDF
- Deploy a WAF with SSRF protection rules in front of Stirling-PDF
🔍 How to Verify
Check if Vulnerable:
Check if Stirling-PDF version is below 1.1.0 and the /api/v1/convert/html/pdf endpoint is accessibleCheck Version:
Check application logs or UI for version information, or inspect docker image tagVerify Fix Applied:
Confirm version is 1.1.0 or later and test SSRF attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connections from Stirling-PDF process
- Multiple requests to /api/v1/convert/html/pdf with suspicious parameters
Network Indicators:
- Outbound connections from Stirling-PDF to internal IP ranges
- HTTP requests to internal services from Stirling-PDF
SIEM Query:
source="stirling-pdf" AND (url_path="/api/v1/convert/html/pdf" OR dest_ip=private_ip_range)