GHSA-5c6w-wwfq-7qqm PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
SummaryPraisonAI's `spider_tools` URL validation can be bypassed using alternate loopback host encodings.The affected component is:The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as `localhost` and `127.0.0.1`.It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request.As a result, URLs such as the following bypass the protection and still reach loopback services:After the weak validation passes, `scrape_page()` calls `requests.Session.get()` on the attacker-controlled URL. This allows an attacker who can influence URLs passed to `scrape_page`, `crawl`, or `extract_text` to induce SSRF requests against loopback-only services.This is a server-side request forgery protection bypass.DetailsThe affected code is in:The vulnerable flow is:The validation appears to block only exact local hostnames or exact IPv4 strings. For example, it blocks simple forms such as:However, equivalent loopback forms are not rejected before the request is made.Confirmed bypass examples:These values can resolve or be interpreted as loopback addresses by the HTTP client / underlying networking stack, while bypassing the string-based validation.The issue is not that `spider_tools` can fetch arbitrary URLs. The issue is that it attempts to provide SSRF protection, but the protection can be bypassed with alternate representations of loopback addresses.PoCThe following PoC is non-destructive. It starts a local HTTP server on `127.0.0.1:8765`, then sends several alternate loopback URL forms through the real `spider_tools` validation/fetch path.The expected secure behavior is that all loopback variants should be rejected before any HTTP request is made.The actual vulnerable behavior is that the alternate loopback forms pass validation and reach the local server.Full PoCConfirmed local resultThe following bypasses were confirmed locally:This demonstrates that the validation allows alternate loopback representations and that the request reaches a local-only HTTP service.Expected secure behaviorAll loopback-equivalent addresses should be blocked before the HTTP request is made.Examples that should be rejected:Actual vulnerable behaviorSeveral alternate loopback representations pass validation and are fetched by the tool.ImpactAn attacker who can influence URLs passed to PraisonAI's spider tools can cause the process to send HTTP requests to loopback-only services.Potential impact includes:SSRF against localhost-only admin panels or development servers;access to local HTTP services that are not intended to be reachable remotely;retrieval of local service responses into the agent/tool output;possible access to cloud metadata or private-network services if equivalent bypasses exist for those address ranges in a given deployment.The most direct confirmed impact is loopback SSRF through alternate hostname/IP encodings.This report does not claim arbitrary TCP access or remote code execution. The demonstrated behavior is HTTP(S) SSRF through the spider URL-fetching feature.
CVSS v3.1 score: 5.5