Overview
In today’s post, we delve into the intricacies of a critical vulnerability discovered in the Stirling-PDF web application, a widely used locally hosted application that performs various operations on PDF files. The vulnerability, identified as CVE-2025-55150, affects the application’s ability to securely convert HTML to PDF, potentially leading to system compromise or data leakage. As the vulnerability scores an 8.6 on CVSS Severity Score, understanding, detecting, and mitigating this risk is of paramount importance to prevent substantial damage to system integrity and confidentiality.
Vulnerability Summary
CVE ID: CVE-2025-55150
Severity: Critical (8.6 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Stirling-PDF | Prior to 1.1.0
How the Exploit Works
The exploit leverages the /api/v1/convert/html/pdf endpoint in the Stirling-PDF application. When converting HTML to PDF, the backend makes a call to a third-party tool and includes a sanitizer for security sanitization. However, due to insufficient security measures in place, an attacker can bypass this sanitizer, leading to a Server Side Request Forgery (SSRF) vulnerability. This allows the attacker to make requests from the vulnerable server to internal resources that would otherwise be inaccessible, potentially leading to system compromise or data leakage.
Conceptual Example Code
Here’s a conceptual example of how the vulnerability might be exploited:
POST /api/v1/convert/html/pdf HTTP/1.1
Host: target.example.com
Content-Type: application/json
{
"html": "<img src='http://localhost:8080/internal_endpoint'>"
}In this example, the attacker is using the HTML to PDF conversion feature to make an internal request, potentially accessing sensitive information or functionality.
Mitigation Guidance
Users of the affected Stirling-PDF versions are urged to apply the vendor patch provided in version 1.1.0 to guard against this vulnerability. As a temporary mitigation measure, users can deploy a Web Application Firewall (WAF) or Intrusion Detection System (IDS) to monitor and block potential SSRF attempts. However, the application of the vendor patch remains the most effective solution to this vulnerability.