GHSA-vg6p-v9vm-6fgj: praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)

Summary

The web_crawl tool in praisonaiagents checks only the initial URL for private, loopback and link-local addresses, resolving the hostname once with socket.gethostbyname. The fetcher then follows redirects through httpx.Client(follow_redirects=True) or urllib.request.urlopen and re-resolves DNS at connect time without re-checking. An attacker can bypass the check with a redirect to internal hosts such as 169.254.169.254 or with DNS rebinding, so an agent can read internal HTTP services and instance-metadata endpoints, with the response body returned in tool output.

Mitigation

Resolve the hostname once, validate that IP, and connect to that exact validated IP (pin it) rather than re-resolving. Disable redirect following (follow_redirects=False; for urllib use a redirect handler that re-validates), or re-validate every redirect hop's resolved IP. Apply the deny check to both the validator and the actual socket target. file_tools.py:364 already uses follow_redirects=False and is the correct pattern to propagate.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online