Vulnerabilidad SSRF en Stirling-PDF en /api/v1/convert/file/pdf

The SSRF vulnerability in Stirling-PDF arises from the use of LibreOffice's unoconvert tool during the "convert file to pdf" functionality. An attacker can craft malicious input that causes unoconvert to make requests to unintended internal or external URLs. This could lead to unauthorized access to sensitive data residing on internal servers, exfiltration of confidential information, or even potential denial-of-service if the attacker can trigger resource-intensive requests. The blast radius extends to any internal services accessible from the Stirling-PDF server, making this a significant risk for environments with complex internal architectures.

Organizations running Stirling-PDF versions prior to 1.1.0, especially those with complex internal networks or exposed internal services, are at risk. Shared hosting environments where Stirling-PDF is deployed alongside other applications could also be vulnerable if the attacker can leverage the SSRF to access other services on the same host.

• linux / server: Monitor Stirling-PDF server logs for unusual outbound HTTP requests, particularly those targeting internal IP addresses or sensitive endpoints. Use journalctl -u stirling-pdf to filter for relevant log entries.

journalctl -u stirling-pdf | grep -i "unoconvert" | grep -i "internal_ip_address"

• generic web: Use curl or wget to test the /api/v1/convert/file/pdf endpoint with URLs pointing to internal resources. Check response headers for signs of SSRF exploitation.

curl -v --head 'http://<stirling-pdf-server>/api/v1/convert/file/pdf?url=http://192.168.1.100/sensitive_data' 

1. 2025-08-11Disclosure

   disclosure

1. Reservado2025-08-07
2. Publicada2025-08-11
3. Modificada2025-08-12
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-55151 is to upgrade Stirling-PDF to version 1.1.0 or later, which contains the fix. If immediate upgrading is not possible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound requests from the Stirling-PDF server, specifically blocking requests to internal IP ranges or known sensitive endpoints. Restrict network access to the Stirling-PDF server to only necessary services. Review and harden the configuration of unoconvert itself, if possible, to limit its ability to make external requests. After upgrade, confirm the fix by attempting a conversion with a URL pointing to an internal resource; the conversion should fail with an appropriate error message.