Description

OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:45.763Z",
  "pubdate": "2026-09-04T15:17:45.763Z",
  "executiveSummary": "The OWL DocumentProcessingToolkit is susceptible to a Server-Side Request Forgery (SSRF) vulnerability within the extract_document_content tool. This security flaw stems from the application's failure to perform adequate validation or filtering on user-supplied URLs provided during the document extraction process.\nBy manipulating input parameters, an attacker can coerce the server into initiating arbitrary HTTP requests to internal network resources, local services, or metadata endpoints. Because the results of these requests are returned directly to the agent context, the vulnerability facilitates data exfiltration and reconnaissance against internal infrastructure that is otherwise shielded from the public internet.\nThe risk associated with this vulnerability is high, as it grants attackers the ability to bypass network segmentation and interact with sensitive internal APIs or cloud metadata services. No specific authentication is required to trigger the vulnerable function if the agent interface is exposed, potentially allowing unauthenticated actors to leverage the server as a proxy to perform lateral movement or discover internal network topologies.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of URL handling within the extract_document_content function. The function accepts a caller-supplied URL and passes it to an underlying request-fetching library without verifying the destination against an allow-list or performing structural validation to block non-routable, private, or sensitive IP ranges (e.g., 127.0.0.1, 169.254.169.254, or RFC 1918 addresses).\nExploitation is achieved through prompt injection, where an attacker crafts a malicious request payload containing a target URL pointing to an internal resource. When the agent processes this input, it invokes the extract_document_content tool using the attacker-controlled URL. The server then performs a server-side request to the specified destination. Because the agent context is designed to parse and return the content fetched from the tool, the raw response—or parsed data—is returned to the attacker, effectively bypassing the server's network boundary.\nThe attack flow follows a clear sequence: First, the attacker identifies the input vector for the extract_document_content tool. Second, the attacker submits a URL targeting a sensitive internal resource, such as a local management interface, a configuration service, or a cloud provider's metadata service. Third, the DocumentProcessingToolkit executes the fetch request under the identity and network context of the server hosting the OWL toolkit. Finally, the application parses the response and feeds the internal content back into the agent's workflow, where it is presented to the user or attacker.\nThis vulnerability is particularly severe because the tool acts as an open proxy for the attacker. If the server resides within a VPC or a secure private network, the attacker can probe for internal services that lack secondary authentication, as the server hosting the toolkit is implicitly trusted by those internal services. Furthermore, if the server is hosted in a cloud environment, the attacker may attempt to query the Instance Metadata Service (IMDS) to retrieve security credentials, environment variables, or other sensitive instance-specific data, leading to full system or environment compromise."
}