GHSA-6h9p-93hq-q7h6: PraisonAI: SpiderTools redirect-target SSRF protection bypass

SpiderTools redirect-target SSRF protection bypass Summary SpiderTools.scrape_page() validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls requests.Session.get() without disabling automatic redirects or validating redirect Location targets. Requests follows redirects by default for GET requests. A safe-looking public URL can therefore pass _validate_url(), redirect to a blocked target such as 127.0.0.1 or 169.254.169.254, and have the redirected response body parsed and returned by scrape_page(). The same sink is used by extract_links(), crawl(), and extract_text() through their calls to scrape_page(). Affected component src/praisonai-agents/praisonaiagents/tools/spider_tools.py Tested affected: - v3.9.24 / d08d98ca - v3.9.26 / 62472a23 - v4.6.56 / d3c4a2af - v4.6.57 / e90d92231853161ad931f3498da57651a9f8b528 - current main 2f9677abb2ea68eab864ee8b6a828fd0141612e1 No patched version is known at report time. Root cause Current main validates only the caller-supplied URL: if not self._validate_url(url): return {"error": f"Invalid or potentially dangerous URL: {url}"} The fetch then uses Requests defaults: response = session.get( url, timeout=timeout, verify=verify_ssl ) Because allow_redirects=False is not set, Requests follows a 3xx redirect to a new destination that has not been checked by _validate_url() or _host_is_blocked(). Proof of vulnerability The PoV below is local-only and does not contact external infrastructure. It starts a loopback-only internal service and a local redirector. During PraisonAI's initial host validation, attacker.test is made to look like a public address. During the actual HTTP request, it routes to the local redirector, which returns 302 Location: http://127.0.0.1:<port>/secret. Full PoV: #!/usr/bin/env python3 """Local PoV for SpiderTools redirect-target SSRF. This uses only loopback services. The "attacker" hostname is treated as public during Pr