PraisonAI: SpiderTools redirect-target SSRF protection bypass
Date: 2026-06
Affected: pip/praisonaiagents
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-918
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

# SpiderTools redirect-target SSRF protection bypass ## Summary `SpiderTools.scrape_page()` validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls `requests.Session.get()` without disabling automatic redirects or validating redirect `Location` targets. Requests follows redirects by default for GET requests. A safe-looking public URL can therefore pass `_validate_url()`, redirect to a blocked target such as `127.0.0.1` or `169.254.169.254`, and have the redirected response body parsed and returned by `scrape_page()`. The same sink is used by `extract_links()`, `crawl()`, and `extract_text()` through their calls to `scrape_page()`. ## Affected component ```text src/praisonai-agents/praisonaiagents/tools/spider_tools.py ``` Tested affected: - `v3.9.24` / `d08d98ca` - `v3.9.26` / `62472a23` - `v4.6.56` / `d3c4a2af` - `v4.6.57` / `e90d92231853161ad931f3498da57651a9f8b528` - current main `2f9677abb2ea68eab864ee8b6a828fd0141612e1` No patched version is known at report time. ## Root cause Current main validates only the caller-supplied URL: ```python if not self._validate_url(url): return {"error": f"Invalid or potentially dangerous URL: {url}"} ``` The fetch then uses Requests defaults: ```python response = session.get( url, timeout=timeout, verify=verify_ssl ) ``` Because `allow_redirects=False` is not set, Requests follows a 3xx redirect to a new destination that has not been checke


Mitigations:

Architectural layers (MAESTRO):