An unauthenticated server-side request forgery vulnerability in Stirling-PDF allows attackers to make unauthorized requests to internal network resources.

This is a Server-Side Request Forgery (CWE-918) vulnerability in the POST /api/v1/convert/url/pdf endpoint. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector.

With a CVSS score of 8.6, this vulnerability represents a significant threat to internal network security. An attacker could leverage this flaw to probe internal infrastructure, access sensitive metadata services, or interact with non-public internal web applications, bypassing perimeter defenses.

Immediate Action: Check the Stirling-PDF repository for security updates and apply the latest version to mitigate the SSRF flaw.

Proactive Monitoring: Monitor network traffic for unexpected outbound requests originating from the server hosting Stirling-PDF, particularly requests directed toward internal IP ranges.

Compensating Controls: Restrict the application server's ability to initiate outbound network connections to internal resources using firewall rules or network segmentation.

Public Exploit Available: No

This vulnerability is highly critical due to its potential for internal network reconnaissance. Users should restrict access to the Stirling-PDF instance until a patch is applied and verify that the application cannot reach sensitive internal endpoints.