Firecrawl hat eine SSRF-Schwachstelle über ein bösartiges Scraping-Ziel

The SSRF vulnerability in Firecrawl allows an attacker to manipulate the scraping engine into making requests to unintended internal resources. By crafting a malicious website that redirects Firecrawl to a local IP address, an attacker can potentially gain access to sensitive information residing on the local network. This could include internal APIs, databases, or other services that are not directly exposed to the internet. The blast radius extends to any resources accessible from the Firecrawl instance's network, potentially impacting other systems and services within the organization. While the maintainers state no user data was exposed, the potential for lateral movement and access to internal systems remains a significant concern.

Organizations utilizing Firecrawl for web scraping, particularly those deploying it within internal networks or behind firewalls, are at risk. Environments where Firecrawl is used to process data from untrusted sources are especially vulnerable. Shared hosting environments where multiple users share a single Firecrawl instance could also be impacted.

• nodejs / server:

  ps aux | grep firecrawl
  journalctl -u firecrawl | grep -i "request to"

• generic web:

  curl -I <firecrawl_endpoint> | grep -i "server"
  grep -i "request to" /var/log/nginx/access.log

1. 2024-12-30Disclosure

   disclosure

2. 2024-12-27Patch

   patch

1. Reserviert2024-12-30
2. Veröffentlicht2024-12-30
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-56800 is to immediately upgrade Firecrawl to version 1.1.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing strict input validation on the URLs provided to Firecrawl. This can help prevent malicious redirects by only allowing requests to trusted domains. Additionally, implement network segmentation to limit the potential impact of a successful SSRF attack. Monitor Firecrawl logs for suspicious outbound requests to internal IP addresses. While no specific WAF rules are available, generic SSRF detection rules can be applied.