PT-2025-12252 · Composiohq · Composio

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-8955

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions composiohq/composio version v0.4.4

Description A Server-Side Request Forgery (SSRF) issue exists, allowing an attacker to read the contents of any file in the system. This is achieved by exploiting the BROWSERTOOL GOTO PAGE and BROWSERTOOL GET PAGE DETAILS actions.

Recommendations For composiohq/composio version v0.4.4, consider disabling the BROWSERTOOL GOTO PAGE and BROWSERTOOL GET PAGE DETAILS actions as a temporary workaround until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-643

CWE-918

Related Identifiers

CVE-2024-8955

GHSA-38MG-WM59-G64X

Affected Products

Composio

References · 7

• 🔥 https://huntr.com/bounties/13bc0399-2d9b-449e-95f2-6e9a7e39383d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8955 · Security Note
• https://osv.dev/vulnerability/GHSA-38mg-wm59-g64x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8955 · Vendor Advisory
• https://github.com/ComposioHQ/composio · Note
• https://github.com/ComposioHQ/composio/blob/master/python/composio/tools/local/browsertool/actions/goto_page.py#L1 · Note
• https://twitter.com/CVEnew/status/1902968900763128134 · Twitter Post