Description

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-15T16:17:46.290Z",
  "pubdate": "2026-09-15T16:17:46.290Z",
  "executiveSummary": "Crawl4AI versions prior to 0.9.3 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability located within the PDFContentScrapingStrategy component. This vulnerability arises due to the application's failure to perform egress validation when handling user-supplied URLs during PDF document retrieval.\nBy manipulating the target URL, an authenticated attacker can force the application to issue unauthorized HTTP requests to arbitrary internal network destinations. This capability enables attackers to interact with services residing behind the organizational perimeter, effectively bypassing network access controls.\nThe primary risk implication involves the potential exfiltration of sensitive internal data. Because the application processes the downloaded PDF and extracts textual content, an attacker can leverage the scraping mechanism to retrieve responses from internal endpoints and view them in the final crawl results. The exploitation of this vulnerability requires the attacker to be authenticated to the system; however, once inside, the lack of egress filtering allows for significant lateral movement or reconnaissance against internal infrastructure and services protected by network segmentation.",
  "technicalDetails": "The vulnerability resides in the _get_pdf_path() function within the PDFContentScrapingStrategy module of Crawl4AI. The root cause is the improper handling of user-supplied URLs passed to the requests library, which performs the document fetching without verifying the destination IP address or validating the protocol against an allowlist.\nThe exploitation flow begins when an authenticated attacker submits a malicious URL to the PDF processing pipeline. The application, failing to implement egress controls, initiates an HTTP request to the attacker-controlled or internal destination provided in the input. An attacker can employ several advanced techniques to weaponize this flaw. First, they may specify internal IP addresses (e.g., 127.0.0.1, 169.254.169.254) or internal hostnames to probe internal services and metadata APIs that are typically inaccessible from the public internet.\nFurthermore, the vulnerability is susceptible to DNS rebinding attacks. In this scenario, the attacker provides a domain name that initially resolves to a public, benign IP address, but is subsequently reconfigured to resolve to an internal, sensitive target. When the application performs the follow-up request, the DNS TTL expiration allows the attacker to redirect the request to an internal resource. Because the PDFContentScrapingStrategy extracts and processes text from the retrieved resource, the internal response—which might contain configuration details, sensitive environmental variables, or operational data—is converted into text and rendered within the application's output logs or crawl results. This mechanism facilitates the exfiltration of sensitive data that would otherwise be protected by internal firewalls.\nThe lack of validation ensures that the requests library follows redirects initiated by the remote server, further expanding the attack surface. An attacker could configure a malicious server to redirect the initial request to sensitive internal endpoints, bypassing basic checks that might only inspect the primary user input. The impact is significant, as it effectively transforms the application into an internal network proxy, allowing the attacker to bypass authentication and access controls for internal web-based management interfaces, local APIs, or microservices that implicitly trust incoming requests from the internal network."
}