Crawl4AI before 0.9.5 Blind SSRF via CacheValidator Freshness Check
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.9.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
Crawl4AI, an open-source web crawling tool, is affected in versions before 0.9.5, particularly its Docker server deployment. An attacker who can use the API could make the server send requests to internal networks and cloud metadata services, bypassing the egress proxy, which could expose internal services and information.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- unclecode crawl4ai
fixed in 0.9.5