Submit #1042368: Stirling-Tools Stirling-PDF 3.2.0 Insufficient Session Expiration (CWE-613)

**Vulnerability Title:** Expired Signing Participant Share Token Allows Unauthorized Retrieval of Participant Metadata in Stirling-PDF 3.2.0

**Vendor:** Stirling-Tools
**Product:** Stirling-PDF
**Affected Version:** 3.2.0 (other versions not yet assessed)
**Weakness Classification:** CWE-613 — Insufficient Session Expiration
**Security Impact:** Information disclosure through incomplete expiration enforcement
**Researcher:** Vu Hoang Dat
**Affiliation:** VNU Information Technology Institute, Vietnam National University, Hanoi, Vietnam

**1. Vulnerability Description**

Stirling-PDF version 3.2.0 contains an inconsistent access-control check in the token-based document signing workflow.

The GET /api/v1/workflow/participant/details endpoint accepts a previously issued participant share token even after its configured expiration timestamp has passed.

Although the participant session and document download endpoints reject expired tokens, the participant details endpoint continues to return HTTP 200 and a JSON response containing participant metadata.

The affected endpoint does not require an authenticated user session. An attacker who already possesses an expired participant share token can therefore continue to retrieve participant information after the token's authorized lifetime has ended.

**2. Affected Component**

File:
app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java

Method:
getParticipantDetails()

The method retrieves the participant using its share token and returns a participant response without checking participant.isExpired().

In comparison, the related session and document access paths enforce participant expiration.

**3. Proof of Concept — Confirmed on Official Release**

Testing was performed on an isolated, locally hosted instance of the official Stirling-PDF v3.2.0 release using Java 25.

The official Stirling-PDF-with-login.jar release artifact was verified against the upstream published SHA-256 digest.

A controlled signing workflow fixture was created in the isolated application database with synthetic participant identities and three token conditions:

- A valid, unexpired participant token.
- A previously issued but expired participant token.
- A nonexistent participant token.

Unauthenticated HTTP requests were issued to the following endpoints:

GET /api/v1/workflow/participant/session?token={token}

GET /api/v1/workflow/participant/details?token={token}

GET /api/v1/workflow/participant/document?token={token}

**4. Actual HTTP Results**

Unexpired token:
- Session endpoint: HTTP 200
- Details endpoint: HTTP 200
- Document endpoint: HTTP 200

Expired token:
- Session endpoint: HTTP 403
- Details endpoint: HTTP 200
- Document endpoint: HTTP 403

Nonexistent token:
- Session endpoint: HTTP 403
- Details endpoint: HTTP 403
- Document endpoint: HTTP 403

The expired-token details response included the controlled participant email address, name, access role, signing status, expiration time and additional participant metadata fields.

The response explicitly reported expired: true while returning HTTP 200.

This demonstrates that expiration is enforced on the other participant endpoints but not on the participant details endpoint.

**5. Security Impact and Preconditions**

An attacker must already possess a previously issued participant share token. Token guessing, extraction of unknown tokens, and access to other participants' records were not demonstrated.

After the token has expired, the affected endpoint can still reveal the corresponding participant's metadata without an authenticated session.

The demonstrated impact is unauthorized continued access to participant metadata beyond the configured token lifetime.

The tests did not demonstrate downloading the PDF with an expired token, account takeover, privilege escalation, remote code execution, or modification of documents.

**6. Independent Source-Level Regression Validation**

A JUnit regression test was added to the official v3.2.0 source tree to assert that getParticipantDetails() rejects an expired participant token with HTTP 403.

On the original source code, the regression test failed because no access-denied exception was raised.

After adding an expiration guard to the affected controller method, the same regression test passed.

Patched test result:
1 test executed, 0 failures, 0 errors.

**7. Suggested Remediation**

Ensure that getParticipantDetails() validates the participant token expiration before returning any metadata.

Expired tokens should receive HTTP 403 or another consistently documented denial response.

Add automated regression coverage across all participant-facing token endpoints to enforce identical expiration semantics.

**8. Validation Environment**

Product: Stirling-PDF 3.2.0
Runtime: Eclipse Temurin OpenJDK x.x.x.x
Operating System: Windows 10
Deployment: Local isolated test server with security-enabled application profile
Test Date: 2026-10-19
Application Address: 127.0.0.1:18473 (local test environment only)

Official Release Artifact SHA-256:
1c26a7046c04692abbbe3dffb043924a308e288f189fa2d9fda9a171c5c8b9de

**9. References**

https://github.com/Stirling-Tools/Stirling-PDF

https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v3.2.0

https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java

https://github.com/Stirling-Tools/Stirling-PDF/security

https://cwe.mitre.org/data/definitions/613.html

**10. Researcher Credit**

Vu Hoang Dat
VNU Information Technology Institute, Vietnam National University, Hanoi
Hanoi, Vietnam

**11. CVE Request**

I request technical evaluation of this confirmed expired-token authorization inconsistency and consideration for CVE assignment if it satisfies CNA vulnerability criteria and does not duplicate a previously reported issue.

• User: Vu Hoang Dat (UID 102178)
• Submission: 10/19/2026 03:58 (26 days ago)
• Moderation: 11/13/2026 18:24 (26 days later)
• Status: Accepted
• VulDB entry: 437206 [Stirling-Tools Stirling-PDF up to 3.3.0 Participant Details Endpoint WorkflowParticipantController.java session timeout]
• Points: 17