Executive brief
Crawl4AI is a web scraping tool used to extract and process content from web pages. Versions before 0.9.3 contain a vulnerability that allows authenticated attackers to trick the server into making requests to internal services (such as cloud metadata endpoints or company databases) that should not be accessible from outside. By providing URLs that redirect to these internal services, attackers can extract sensitive information like credentials through the application's PDF processing feature.
Technical details
The vulnerability is a server-side request forgery (SSRF) in PDFContentScrapingStrategy's _get_pdf_path() function, which uses Python's requests library to download PDFs with allow_redirects=True but does not validate the final destination IP address. An authenticated attacker can supply a public URL that redirects to internal addresses (RFC1918 ranges, 127.0.0.1, 169.254.169.254 cloud metadata), which requests automatically follows without triggering egress validation controls. Additionally, DNS rebinding attacks are possible because the seed URL is re-resolved by requests after the one-time validate_url_destination() check. If the fetched content parses as a PDF, the extracted text is returned in the crawl result, allowing exfiltration of internal service responses. The vulnerability affects non-streaming crawl handlers and is exploitable because PDFContentScrapingStrategy is in UNTRUSTED_ALLOWED_TYPES. Patch version 0.9.3 is available.
Affected products
- unclecode Crawl4AI < 0.9.3
Timeline
- 2026-08-31: disclosed
- 2026-09-15: advisory
- 2026-08-31: patched: Version 0.9.3 released with fix