Firecrawl Playwright 服务缺少 Post-Redirect 验证导致 SSRF 保护绕过

攻击者可以利用此 SSRF 漏洞绕过 Firecrawl 的网络策略验证，通过 HTTP 重定向访问内部网络资源。攻击者首先提供一个看似合法的外部 URL，该 URL 会返回一个重定向到内部或受限资源的 HTTP 重定向。由于 Firecrawl 只验证初始 URL，而未验证重定向目标，浏览器会跟随重定向并获取最终目标，从而允许攻击者访问原本受保护的内部服务和敏感端点。这可能导致信息泄露、权限提升，甚至进一步的攻击。

Organizations utilizing Firecrawl for web scraping, particularly those with sensitive internal services or data, are at risk. Shared hosting environments where Firecrawl is deployed alongside other applications are also vulnerable, as a compromised Firecrawl instance could be used to pivot to other tenants.

• linux / server: Monitor Firecrawl logs for unusual outbound requests to internal IP addresses or services. Use journalctl -u firecrawl to filter for suspicious activity.

journalctl -u firecrawl | grep -i "internal_ip_address"

• generic web: Use curl to test for SSRF by attempting to access internal resources through Firecrawl.

curl -v 'http://localhost/crawl?url=http://internal-service/sensitive-data' 

• generic web: Examine access logs for requests to unusual or unexpected internal URLs originating from the Firecrawl service.

1. 2026-03-26Disclosure

   disclosure

1. 已保留2026-03-16
2. 发布日期2026-03-26
3. 修改日期2026-03-30
4. EPSS 更新日期2026-04-03

为了缓解 CVE-2026-32857 的影响，建议立即升级到 Firecrawl 的修复版本。如果无法立即升级，可以考虑以下临时缓解措施：实施严格的网络策略，限制 Firecrawl 访问的外部资源；配置防火墙规则，阻止对内部资源的未经授权的访问；审查 Firecrawl 的配置，确保网络策略配置正确。在升级后，请验证网络策略是否生效，并确认 Firecrawl 无法访问内部资源。