A critical Server-Side Request Forgery vulnerability in Stirling-PDF allows unauthenticated attackers to perform unauthorized requests, posing a significant risk to internal network security.

The application fails to properly sanitize inputs when using the /api/v1/convert/html/pdf endpoint to convert HTML to PDF, allowing an unauthenticated attacker to bypass security measures and perform Server-Side Request Forgery (SSRF).

Successful exploitation of this SSRF vulnerability could allow an attacker to interact with internal services that are not exposed to the public internet, potentially leading to unauthorized data access or internal reconnaissance. Given the CVSS score of 8.6, this flaw represents a high-severity risk that could facilitate lateral movement within the network or compromise sensitive internal infrastructure.

Immediate Action: Update Stirling-PDF to version 1.1.0 or later to apply the necessary security sanitization patches.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at the /api/v1/convert/html/pdf endpoint and review outbound network traffic from the application server for suspicious connection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block malicious payloads in HTML-to-PDF conversion requests until the application can be updated.

Public Exploit Available: No (a Nuclei detection template exists, but there is no confirmed weaponized exploit or public proof-of-concept).

The vulnerability in Stirling-PDF presents a substantial risk due to the ability for unauthenticated actors to abuse the conversion API for SSRF attacks. Organizations should prioritize patching to version 1.1.0 immediately to eliminate this attack vector. Failure to remediate could allow attackers to bypass perimeter defenses and target internal network assets.