Yashon

The ` safe eval expression()` function in the computed fields feature uses an AST (Abstract Syntax Tree) validator that only blocks attributes starting with an underscore. Because Python generator and frame object attributes such as `gi frame`, `f back`, and `f builtins` do not start with an underscore, they can be used to escape the sandbox and achieve arbitrary code execution. An unauthenticated attacker can trigger this by sending a 'POST /crawl' request with a crafted `JsonCssExtractionStrategy` schema containing a malicious computed field expression. This allows the attacker to access the frame chain, reach `f builtins` to import the `os` module, and execute arbitrary system commands inside the Docker container, potentially leading to file system access and secret exfiltration.

The Docker API server contains an authentication bypass issue caused by a hardcoded default JWT (JSON Web Token) signing key. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties. Because the secret used to sign these tokens is publicly known, a remote attacker can forge valid tokens for any user to bypass authentication and gain full access to protected functionality.

Multiple security issues affect the Crawl4AI Docker API server. The software is susceptible to Server-Side Request Forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location, through the '/crawl', '/crawl/stream', '/md', '/llm', '/crawl/job', and '/llm/job' endpoints. Attackers can bypass internal-address blocklists using IPv6-mapped IPv4 addresses to access internal services, Docker networks, and cloud metadata endpoints. Additionally, the '/screenshot' and '/pdf' endpoints allow arbitrary file writes via the `output path` parameter, enabling the overwriting of server files. The '/execute js' endpoint allows arbitrary JavaScript execution in the server's browser. Other issues include an authentication bypass on monitor endpoints, stored Cross-Site Scripting (XSS) in the monitor dashboard, and a hardcoded JWT secret key that allows the forgery of authentication tokens.

A stored cross-site scripting issue exists in the monitor dashboard. The application renders crawl URLs and error messages using `innerHTML` without proper escaping. This allows an attacker to submit a crafted crawl request containing malicious markup, which then executes in the browser of an operator viewing the dashboard.

Multiple security issues affect the Crawl4AI Docker API server: - The `/execute js` endpoint allows arbitrary JavaScript execution in the server's browser context because `--disable-web-security` is enabled, which can be used to perform server-side request forgery (SSRF) against internal services. - The `/screenshot` and `/pdf` endpoints are susceptible to arbitrary file write via the `output path` parameter, allowing attackers to overwrite server files or write to any appuser-writable location. - SSRF is possible through the `/crawl/job` and `/llm/job` endpoints via webhook URLs, as well as through the `/crawl`, `/crawl/stream`, `/md`, and `/llm` endpoints. Attackers can bypass internal-address blocklists using IPv6-mapped IPv4 addresses to access internal services and cloud metadata endpoints. - An authentication bypass exists in the monitor router, making endpoints such as `/monitor/actions/cleanup` accessible without authentication. - The monitor dashboard is vulnerable to stored cross-site scripting (XSS) because it renders crawl URLs and error messages using `innerHTML` without proper escaping. - The system uses a hardcoded JWT secret key defaulting to `mysecret`, enabling the forgery of authentication tokens.