CyberRota Analysis
AI-GeneratedThe vulnerability exists in the Jobs API of PraisonAI prior to version 4.6.58, where the validate_webhook_url() function fails to properly validate webhook URLs, allowing an attacker to exploit this flaw. This could lead to unauthorized access to internal services by resolving the webhook URL to local or internal addresses. Organizations using affected versions of PraisonAI should prioritize upgrading to version 4.6.58 to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, the Jobs API validate_webhook_url() path fails open on socket.gaierror and does not bind the validated address to the later request. An attacker webhook_url can later resolve to 127.0.0.1, 169.254.169.254, or another internal address. This issue is fixed in version 4.6.58.