CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 4.6.78 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the Jobs API, specifically through the /api/v1/runs endpoint. This flaw allows attackers to exploit DNS rebinding to access internal services, potentially leading to unauthorized data exposure or manipulation. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI before 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.