CVE-2024-0243: langchain-ai langchain-ai/langchain Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2024-0243 is a high (CVSS 8.1) Server-Side Request Forgery (SSRF) vulnerability in langchain-ai langchain-ai/langchain. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 24-02-2024
   PublishedVulnerability first disclosed.
2. 22-04-2025
   Last modifiedVulnerability information updated.

Description

With the following crawler configuration: ```python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader( url=url, max_depth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load() ``` An attacker in control of the contents of `https://example.com` could place a malicious HTML file in there with links like "https://example.completely.different/my_file.html" and the crawler would proceed to download that file as well even though `prevent_outside=True`. https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchain_community/document_loaders/recursive_url_loader.py#L51-L51 Resolved in https://github.com/langchain-ai/langchain/pull/15559

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.