PraisonAIAgents presenta SSRF y Lectura de Archivos Locales a través de URLs No Validadas en la Herramienta web_crawl

The SSRF vulnerability in PraisonAIAgents arises from insufficient validation of URLs provided to the web_crawl() function. Malicious actors, or even prompt injection within crawled content, can craft URLs that instruct the agent to fetch sensitive data. This could include accessing cloud metadata endpoints (e.g., AWS instance IDs, Azure credentials), internal services that are not publicly exposed, or even local files accessible via file:// URLs. The blast radius extends to any data accessible by the PraisonAIAgents process, potentially compromising the entire system and any connected resources. Exploitation could lead to unauthorized access to sensitive information, lateral movement within the network, and even remote code execution if the fetched data is subsequently processed without proper sanitization.

Organizations utilizing PraisonAIAgents in environments with sensitive internal resources or cloud metadata endpoints are particularly at risk. Shared hosting environments where multiple users share the same PraisonAIAgents instance could also be vulnerable, as a compromised agent could potentially access data belonging to other users.

• linux / server: Monitor PraisonAIAgents logs for requests containing file:// URLs. Use journalctl -u praisonaiagents to filter for relevant entries.

journalctl -u praisonaiagents | grep 'file://'

• python / supply-chain: Inspect the praisonaiagents/tools/webcrawltools.py file for the web_crawl() function and confirm that URL validation is implemented.

def web_crawl(url):
    # Ensure proper URL validation is present here
    if not is_valid_url(url):
        raise ValueError("Invalid URL")
    # ... rest of the function

• generic web: Monitor web server access logs for requests originating from the PraisonAIAgents process attempting to access local files via file:// URLs.

1. 2026-04-09Disclosure

   disclosure

1. Reservado2026-04-09
2. Publicada2026-04-09
3. Modificada2026-04-14
4. EPSS actualizado2026-04-17

The primary mitigation for CVE-2026-40150 is to immediately upgrade PraisonAIAgents to version 1.5.128 or later. If upgrading is not immediately feasible due to compatibility issues or system downtime constraints, consider implementing temporary workarounds. These might include restricting network access for the PraisonAIAgents process to only necessary resources, or implementing a Web Application Firewall (WAF) with rules to block suspicious URLs containing file:// schemes or known internal network patterns. Carefully review and sanitize any data received from external sources before processing it within the PraisonAIAgents system. After upgrading, confirm the fix by attempting to trigger the web_crawl() function with a file:// URL pointing to a known, non-sensitive local file; the request should be rejected.