Executive brief
The web_crawl tool in PraisonAI Agents is used to fetch and analyze content from web URLs. An attacker can bypass its internal-network protection by crafting HTTP redirects or using DNS rebinding to make the tool access cloud metadata endpoints or internal services that should be blocked, potentially exposing sensitive credentials such as AWS IAM keys. This vulnerability can be triggered via direct user input or prompt injection attacks against AI agents that use this tool.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) stemming from a time-of-check time-of-use (TOCTOU) gap in src/praisonaiagents/tools/web_crawl_tools.py. The validation logic resolves the hostname once at check time using socket.gethostbyname() and rejects private/loopback/link-local IPs. However, the actual fetcher (httpx.Client with follow_redirects=True, or urllib.request.urlopen as fallback) re-resolves the hostname at connect time without re-validation. This gap is exploitable via two independent attack vectors: (1) HTTP redirects where a public-IP domain is approved at validation but the attacker's server responds with a 302 redirect to an internal address (e.g., 169.254.169.254), which the fetcher follows unchecked; and (2) DNS rebinding where a low-TTL attacker domain resolves to a public IP during validation but to a private/loopback address during the actual connection. An agent controlled via direct input or prompt injection can thereby read internal HTTP services and cloud metadata endpoints, leaking sensitive data such as IAM credentials. The patch is to pin the validated IP and connect to it directly, disable redirect following, or re-validate every redirect hop.
Affected products
- MervinPraison PraisonAI Agents < 1.6.58
Timeline
- 2026-06-13: disclosed: Advisory initially published by GitHub
- 2026-08-05: advisory: Published to NVD
- 2026-08-25: advisory: Updated in GitHub Advisory Database
- 2026-06-13: patched: Fixed in version 1.6.58 (commit 2f9677a)