Executive brief
PraisonAI's web_crawl function validates initial URLs to block access to private and loopback network endpoints, but fails to validate HTTP redirect destinations. An attacker can craft a public URL that redirects to private networks or cloud metadata services, allowing the tool to access sensitive internal resources. This could expose internal services, private network infrastructure, or cloud metadata credentials that should only be accessible locally.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) bypass in the web_crawl() function and its httpx fallback (_crawl_with_httpx()). The root cause is incomplete URL validation: while the initial URL is checked via socket.gethostbyname() to reject loopback/private/link-local addresses (unless ALLOW_LOCAL_CRAWL=true), the httpx.Client is configured with follow_redirects=True and performs no validation on intermediate or final redirect targets. An attacker can supply a public URL that passes initial validation but redirects via 302/3xx responses to loopback (127.0.0.1), private networks (10.x.x.x, 172.16-31.x.x, 192.168.x.x), or cloud metadata endpoints (169.254.169.254). The response body from the redirected endpoint is returned in the web_crawl() result. The fix requires either disabling redirect following or implementing per-redirect URL validation using socket.getaddrinfo() rather than a single gethostbyname() call. Patched in version 1.6.58; affected versions 1.5.128 through 1.6.56.
Affected products
- MervinPraison PraisonAI >=1.5.128, <1.6.58
Timeline
- 2026-06-13: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: Fixed in version 1.6.58