CyberRota Analysis
AI-GeneratedThe vulnerability affects the Stirling-PDF web application, specifically the /api/v1/pipeline/handleData endpoint, which improperly exposes the STIRLING-PDF-BACKEND-API-USER API key to authenticated ROLE_USER users. This flaw allows attackers to impersonate the internal service account, bypass rate limits, and access sensitive internal endpoints, potentially leading to unauthorized data exposure. Organizations using versions prior to 2.9.0 should prioritize upgrading to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests, allowing an authenticated ROLE_USER to retrieve the key through /api/v1/user/get-api-key, impersonate the internal service account, bypass normal rate limits, and access internal endpoints including /api/v1/info/requests/all and /api/v1/info/load/all. This issue is fixed in version 2.9.0.