Technical impact
This SSRF vulnerability arises from a DNS fail‑open condition in PraisonAI's webhook validation. When the system cannot resolve the specified webhook URL, the code swallows the error and later performs a new lookup during the webhook dispatch, allowing the attacker to change the DNS entry to point to an internal service. The attack lets an attacker force PraisonAI to issue HTTP requests to arbitrary internal resources, potentially exposing sensitive data or enabling further attacks. The weakness is a Server‑Side Request Forgery (CWE‑918) compounded by failed DNS handling (CWE‑367) and a partial trust boundary (CWE‑705).
Affected Systems
The vulnerability affects all installations of MervinPraison PraisonAI before version 4.6.58. All releases up to, but not including, 4.6.58 are susceptible. The affected component is the JobSubmitRequest.validate_webhook_url() routine in the PraisonAI codebase. No other products or vendors are affected.
Risk and Exploitability
The CVSS score of 7.1 indicates high impact. The EPSS score is not available, but the lack of KEV listing suggests no publicly known exploitation yet. The likely attack vector is the submission of a job with a crafted webhook_url that triggers the DNS lookup failure. Attackers could exploit this to reach internal networks, exfiltrate data, or pivot into other systems. Patching to 4.6.58 eliminates the vulnerable control flow and removes the possibility of DNS fail‑open exploitation.
Github GHSA