Evertrustai

**Name of the Vulnerable Software and Affected Versions** praisonaiagents versions prior to 1.6.58 **Description** A Server-Side Request Forgery (SSRF) issue exists in the multi-agent teams system. The function ` host is blocked()` in `spider tools.py` fails to perform DNS resolution on hostnames before they are processed by the `scrape page` function. Consequently, an attacker can use public wildcard DNS services (e.g., `127.0.0.1.nip.io`) to bypass validation and force the system to make HTTP requests to internal loopback or private network addresses. This allows for arbitrary port access and the exfiltration of internal service responses. This issue affects the following LLM-callable agent tools: - `scrape page` - `extract links` - `crawl` - `extract text` In cloud environments, such as AWS EC2 using IMDSv1, this could lead to the theft of temporary IAM credentials and full cloud account compromise. **Recommendations** Update praisonaiagents to version 1.6.58 or later. As a temporary workaround, restrict the use of the `scrape page`, `extract links`, `crawl`, and `extract text` tools when processing user-supplied URLs.

**Name of the Vulnerable Software and Affected Versions** praisonaiagents versions prior to 1.6.58 **Description** An arbitrary file write issue exists due to improper sanitization of the `user id` parameter in the `FileMemory. init ()` function. When the `FileMemory` constructor joins the `user id` into `self.user path` without validation, a caller can provide path separators or `../` sequences to escape the intended memory directory. This allows an attacker to write JSON data to any location on the filesystem that the process has permission to write to. This can be exploited via the direct Python API, the `Agent` constructor, or through `agents.yaml` and job submissions. **Recommendations** Update praisonaiagents to version 1.6.58 or later. As a temporary workaround, restrict the use of the `user id` parameter to only allow alphanumeric characters, hyphens, underscores, and dots.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** A Server-Side Request Forgery (SSRF) issue exists due to a Time-of-Check to Time-of-Use (TOCTOU) flaw and a fail-open DNS validation mechanism. The `JobSubmitRequest.validate webhook url()` function validates webhook URLs by resolving the hostname to check for private IP addresses; however, if a DNS resolution error occurs (`socket.gaierror`), the validator silently allows the URL. Subsequently, the `JobExecutor. send webhook()` function performs a fresh DNS lookup at execution time. An attacker can exploit this by submitting a `webhook url` that initially does not resolve to bypass validation and then updating the DNS to point to an internal IP address, directing the final request to an internal service. This can lead to the exfiltration of job results or unauthorized interaction with internal infrastructure. **Recommendations** Update PraisonAI to version 4.6.58. As a temporary mitigation, restrict access to the `POST /jobs` endpoint to trusted callers only.

**Name of the Vulnerable Software and Affected Versions** PraisonAI versions prior to 4.6.58 **Description** The Browser Server contains an authentication bypass in the ` handle connection()` function. The server validates incoming WebSocket connections by checking the Chrome extension origin using `re.match()` with the expression `chrome-extension://[a-z0-9]{32}`. Because `re.match()` only anchors at the start of the string and not the end, any Origin header containing more than 32 alphanumeric characters after the scheme will pass the check. An attacker can bypass this validation by forging an Origin header with 33 or more characters. Once connected, the attacker can send `start session` commands to the server, which are then broadcast to any connected Chrome extension. This allows for unauthorized browser automation, including the theft of session cookies from all open tabs and the capture of screenshots. **Recommendations** Update PraisonAI to version 4.6.58 or later. As a temporary mitigation, restrict access to the Browser Server to only trusted local interfaces and avoid enabling remote access via `PRAISONAI BROWSER ALLOW REMOTE=true`.