CyberRota Analysis
AI-GeneratedThe web_crawl tool in PraisonAI versions prior to 1.6.58 is vulnerable to Server-Side Request Forgery (SSRF), allowing attackers to bypass security checks and connect to internal destinations of their choosing. This vulnerability can be exploited via HTTP redirects and DNS rebinding, potentially exposing sensitive internal data or cloud metadata. Organizations using affected versions should prioritize upgrading to version 1.6.58 to mitigate the risk of unauthorized access to internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. In versions prior to 1.6.58, the web_crawl tool performs its SSRF check only on the initially supplied URL, allowing the protection to be bypassed so the tool connects to attacker-chosen internal destinations. The check resolves the hostname once with socket.gethostbyname and rejects private/loopback/link-local results, but then passes the URL to a fetcher using httpx.Client(follow_redirects=True) (or urllib.request.urlopen when httpx is absent, which also follows redirects) that re-resolves the hostname at connect time with no further validation. This validate-here/fetch-there gap is exploitable through both HTTP redirects and DNS rebinding. If an attacker can influence URLs passed to web_crawl(), directly or through an agent/tool workflow, they can cause the PraisonAI host to fetch loopback, private-network, or cloud metadata endpoints reachable from that host, with the response body returned in the web_crawl() result. This issue has been fixed in version 1.6.58.