CyberRota Analysis
AI-GeneratedCrawl4AI versions prior to 0.9.3 are vulnerable to a server-side request forgery (SSRF) that allows authenticated attackers to manipulate URL requests, potentially redirecting them to internal network services. This vulnerability can lead to unauthorized access and data exfiltration through PDF content extraction. Organizations using affected versions should prioritize patching to mitigate the risk of internal service exposure and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.