PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the initial URL and lets requests.Session.get follow redirects automatically, so a public-looking URL can redirect to a loopback, private, link-local, or metadata address without revalidation. The redirected response body is returned through scrape_page and its extract_links, crawl, and extract_text callers, allowing disclosure from otherwise blocked services. This issue is fixed in praisonaiagents 1.6.59.
Affected: PyPI: praisonaiagents
# SpiderTools redirect-target SSRF protection bypass
## Summary
`SpiderTools.scrape_page()` validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls `requests.Session.get()` without disabling automatic redirects or validating redirect `Location` targets.
Requests follows redirects by default for GET requests. A safe-looking public URL can therefore pass `_validate_url()`, redirect to a blocked target such as `127.0.0.1` or `169.254.169.254`, and have the redirected response body parsed and returned by `scrape_page()`.
The same sink is used by `extract_links()`, `crawl()`, and `extract_text()` through their calls to `scrape_page()`.
## Affected component
```text src/praisonai-agents/praisonaiagents/tools/spider_tools.py ```
Tested affected:
- `v3.9.24` / `d08d98ca` - `v3.9.26` / `62472a23` - `v4.6.56` / `d3c4a2af` - `v4.6.57` / `e90d92231853161ad931f3498da57651a9f8b528` - current main `2f9677abb2ea68eab864ee8b6a828fd0141612e1`
No patched version is known at report time.
## Root cause
Current main validates only the caller-supplied URL:
```python if not self._validate_url(url): return {"error": f"Invalid or potentially dangerous URL: {url}"} ```
The fetch then uses Requests defaults:
```python response = session.get( url, timeout=timeout, verify=verify_ssl ) ```
Because `allow_redirects=False` is not set, Requests follows a 3xx redirect to a new destination that has not been check…
Affected: PyPI: praisonaiagents
# SpiderTools redirect-target SSRF protection bypass
## Summary
`SpiderTools.scrape_page()` validates the initial URL and rejects direct loopback, private, link-local, metadata, and internal hostnames. It then calls `requests.Session.get()` without disabling automatic redirects or validating redirect `Location` targets.
Requests follows redirects by default for GET requests. A safe-looking public URL can therefore pass `_validate_url()`, redirect to a blocked target such as `127.0.0.1` or `169.254.169.254`, and have the redirected response body parsed and returned by `scrape_page()`.
The same sink is used by `extract_links()`, `crawl()`, and `extract_text()` through their calls to `scrape_page()`.
## Affected component
```text src/praisonai-agents/praisonaiagents/tools/spider_tools.py ```
Tested affected:
- `v3.9.24` / `d08d98ca` - `v3.9.26` / `62472a23` - `v4.6.56` / `d3c4a2af` - `v4.6.57` / `e90d92231853161ad931f3498da57651a9f8b528` - current main `2f9677abb2ea68eab864ee8b6a828fd0141612e1`
No patched version is known at report time.
## Root cause
Current main validates only the caller-supplied URL:
```python if not self._validate_url(url): return {"error": f"Invalid or potentially dangerous URL: {url}"} ```
The fetch then uses Requests defaults:
```python response = session.get( url, timeout=timeout, verify=verify_ssl ) ```
Because `allow_redirects=False` is not set, Requests follows a 3xx redirect to a new destination that has not been check…