CyberRota Analysis
AI-GeneratedPraisonAI versions prior to 1.6.78 are vulnerable to a server-side request forgery (SSRF) flaw in the web_crawl tool, which improperly handles hostname validation during connection establishment. This vulnerability allows attackers to exploit DNS rebinding techniques to access internal HTTP response bodies from private or loopback services, potentially leading to unauthorized data exposure. Organizations using affected versions should prioritize patching to mitigate the risk of internal network breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.