CVE-2025-55161
📋 TL;DR
CVE-2025-55161 is a Server-Side Request Forgery (SSRF) vulnerability in Stirling-PDF's Markdown-to-PDF conversion endpoint. Attackers can bypass security sanitization to make unauthorized requests to internal systems. This affects all Stirling-PDF instances running versions before 1.1.0.
💻 Affected Systems
- Stirling-PDF
📦 What is this software?
Stirling Pdf by Stirlingpdf
⚠️ Risk & Real-World Impact
Worst Case
Full internal network compromise allowing attackers to access sensitive internal services, exfiltrate data, or pivot to other systems.
Likely Case
Information disclosure from internal services, potential data exfiltration, and reconnaissance of internal network infrastructure.
If Mitigated
Limited impact if network segmentation restricts internal service access and proper input validation is in place.
🎯 Exploit Status
Exploitation requires sending specially crafted requests to the vulnerable endpoint. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0
Vendor Advisory: https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-ff33-grr6-rmvp
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Stirling-PDF to version 1.1.0 or later. 3. Restart the Stirling-PDF service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable Markdown-to-PDF endpoint
allTemporarily disable the vulnerable /api/v1/convert/markdown/pdf endpoint
Modify Stirling-PDF configuration to disable the endpoint or block access via reverse proxy/load balancer
Network segmentation
allRestrict Stirling-PDF instance from making outbound requests to internal networks
Configure firewall rules to block outbound requests from Stirling-PDF to internal IP ranges
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Stirling-PDF from sensitive internal services
- Deploy a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if Stirling-PDF version is below 1.1.0 and the /api/v1/convert/markdown/pdf endpoint is accessibleCheck Version:
Check Stirling-PDF web interface or configuration files for version informationVerify Fix Applied:
Confirm Stirling-PDF version is 1.1.0 or later and test the endpoint with SSRF payloads to verify sanitization📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /api/v1/convert/markdown/pdf endpoint
- Outbound requests from Stirling-PDF to internal IP addresses
Network Indicators:
- HTTP requests from Stirling-PDF to internal services not normally accessed
- Unusual traffic patterns from Stirling-PDF instance
SIEM Query:
source="stirling-pdf" AND (uri="/api/v1/convert/markdown/pdf" OR dest_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16))