CyberRota Analysis
AI-GeneratedThe vulnerability affects the Stirling-PDF's POST /api/v1/convert/url/pdf endpoint in Java, which lacks the necessary SSRF protections found in other conversion endpoints. This oversight allows attackers to exploit the endpoint to retrieve sensitive internal resources or cloud metadata by embedding malicious URLs in the HTML, potentially leading to significant data leaks. Organizations utilizing this PDF conversion functionality should prioritize patching this vulnerability to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).