CyberRota Analysis
AI-GeneratedThe DocumentProcessingToolkit from OWL is vulnerable to a server-side request forgery (SSRF) in its extract_document_content tool, allowing attackers to exploit the lack of URL validation. This vulnerability enables the injection of malicious URLs, potentially exposing internal resources and sensitive data. Organizations using this toolkit should prioritize remediation to mitigate the risk of unauthorized access and data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OWL's DocumentProcessingToolkit contains a server-side request forgery vulnerability in the extract_document_content tool that fetches caller-supplied URLs with no scheme, host, or IP filtering. Attackers can inject malicious URLs through prompt injection to make the server fetch internal resources, with responses returned to the agent context.