Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.

Affected: PyPI: PraisonAI

### Summary The `webhook_url` field in the Jobs API silently passes validation when DNS resolution fails (`socket.gaierror`), enabling DNS rebinding attacks. An attacker's domain can initially resolve to a public IP (passing validation) then switch to an internal IP before the server makes the HTTP request.

### Details The validator catches `socket.gaierror` and silently allows the URL:

```python # src/praisonai/praisonai/jobs/models.py:55 try: ip = socket.gethostbyname(hostname) ip_obj = ipaddress.ip_address(ip) if ip_obj.is_private or ip_obj.is_loopback: raise ValueError("private address") except socket.gaierror: pass # BUG: DNS failure silently ignored → SSRF bypass ```

The HTTP call is made later with no re-validation:

```python # src/praisonai/praisonai/jobs/executor.py:402 async with httpx.AsyncClient() as client: await client.post(job.webhook_url, ...) # no second IP check ```

### Proof of Concept

**DNS rebinding flow:** 1. Register `attacker.com` with TTL=1s → resolves to `1.2.3.4` (public IP) 2. Submit job: `webhook_url=http://attacker.com/callback` 3. Validation passes (public IP) 4. Switch DNS: `attacker.com` → `127.0.0.1` 5. Job completes → server POSTs to `127.0.0.1` → internal SSRF

**Unresolvable domain bypass (no DNS rebinding required):**

```bash curl -X POST http://:8005/api/v1/runs \ -d '{"prompt":"run","webhook_url":"http://unresolvable.internal/cb","agent_yaml":"..."}' # Validation: gaierror → pass → URL accepted ``…