GHSA-rjvw-7vvw-549v PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
Jobs webhook SSRF protection bypass via DNS rebindingSummaryPraisonAI's Async Jobs API validates `webhook_url` when a job request is parsed
and again when the internal `Job` object is constructed. That validation blocks
direct loopback/private targets, but it is not bound to the later network
request. When a job completes, `_send_webhook()` passes the original hostname to
`httpx.AsyncClient.post()` with no send-time validation, IP pinning, or guarded
transport.An attacker-controlled hostname can therefore resolve to a public IP during
Pydantic validation and later resolve to loopback/private/cloud-metadata
infrastructure during webhook delivery. This bypasses the intended SSRF guard in
current supported releases.This appears to be an incomplete fix / patch bypass for `GHSA-8frj-8q3m-xhgm`
("Server-Side Request Forgery via Unvalidated webhook_url in Jobs API"). I defer
to maintainers on whether this should be a new advisory/CVE or an amendment to
the prior advisory, but current supported releases still appear affected.Affected ComponentPackage:Files:Relevant code paths:Affected VersionsValidated affected:`v4.5.126` (`f00763937bf7f4d091e84533692fc0576fca9b99`);`v4.5.128` (`b4e3a8a8`);`v4.6.56` (`d3c4a2af`);`v4.6.57` (`e90d92231853161ad931f3498da57651a9f8b528`);current `main` (`2f9677abb2ea68eab864ee8b6a828fd0141612e1`,
`v4.6.57-4-g2f9677ab`).Suggested affected range for maintainer confirmation:No patched version is known to me at submission time.`v4.5.124` and earlier are covered by the older unvalidated-webhook advisory.
This report is scoped to patched-era releases where direct loopback/private
webhook URLs are rejected but DNS rebinding still bypasses the guard.Root CauseCurrent validation is a time-of-check/time-of-use boundary:`JobSubmitRequest.webhook_url` is validated with `urlparse()` and
`socket.gethostbyname()`.The resolved address is rejected when it is private, loopback, link-local, or
multicast.The original URL string is stored on the `Job`.After job completion, `_send_webhook()` creates a fresh `httpx.AsyncClient`
and POSTs to the original URL.`httpx` resolves the hostname again. There is no revalidation of the address
that is actually connected to.The first DNS answer is therefore trusted for a later, independent DNS lookup.
An attacker who controls DNS for the webhook hostname can return a public
address during validation and an internal address during delivery.Local ReproductionThe PoV is local-only. It starts a loopback HTTP server, monkeypatches resolver
behavior in-process, and uses the real PraisonAI `Job` validator plus
`JobExecutor._send_webhook()` sender.Run from a PraisonAI checkout:Observed output on current `main`:The direct control proves that the current guard is meant to reject loopback
webhook destinations. The rebind case proves the same blocked destination class
is reached when the hostname changes between validation and delivery.Full Local PoV ScriptIntended-Behavior ValidationPraisonAI's Async Jobs documentation describes `webhook_url` as the completion
callback URL for submitted jobs. The deploy API docs list webhooks as a key
feature and state that the async jobs API does not require authentication by
default, with authentication left to server deployment configuration.The code also proves the intended safety boundary: both `JobSubmitRequest` and
`Job` currently reject direct `http://127.0.0.1:<port>/...` webhook URLs. The
PoV does not rely on local webhooks being intentionally allowed; it demonstrates
that a blocked local target becomes reachable after the validation-to-use DNS
transition.ImpactIf an attacker can submit jobs to a PraisonAI Jobs API deployment and choose
`webhook_url`, they can cause the PraisonAI host to send POST requests to
loopback, private-network, or cloud metadata endpoints reachable from that host.Practical impact includes:blind interaction with internal HTTP services;internal host/port reachability probing via timing and webhook error behavior;POSTing attacker-controlled job result payloads to internal APIs with weak
request validation;cloud metadata interaction where metadata endpoints accept the request method
and the deployment network permits access.This report does not claim response-body disclosure, RCE, or live credential
theft without deployment-specific internal-service behavior. The SSRF primitive
is still security-relevant because webhook delivery crosses a network boundary
that current code explicitly tries to block.SeveritySuggested severity: High for network-reachable Jobs API deployments where job
submission is unauthenticated or attacker-accessible.If maintainers model the Jobs API as loopback-only or authenticated in the
affected deployment, severity may reasonably be reduced. I kept the primary
rating aligned with the prior Jobs webhook SSRF advisory because PraisonAI's
public docs state that authentication is not required by default and the same
webhook sink remains reachable.Suggested FixMove SSRF validation to the send path immediately before opening the outbound
connection.Resolve all candidate addresses with `socket.getaddrinfo()`, not only the
first IPv4 answer from `gethostbyname()`.Reject loopback, private, link-local, multicast, reserved, unspecified, and
cloud metadata address ranges for every resolved address.Pin the validated address to the actual connection, or use a guarded HTTP
transport/proxy that validates the destination after DNS resolution and before
connect.Consider making Jobs API authentication mandatory by default for non-loopback
binds, or require explicit opt-in to unauthenticated job submission.Add regression tests for direct loopback rejection, DNS rebind from public to
loopback, IPv6/private AAAA records with public A records, and allowed public
webhooks.
CVSS v3.1 score: 7.2