Description
Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetch_ssl_certificate=true with crafted userinfo URLs so SSLCertificate.from_url connects to internal hosts on port 443, probing reachability and leaking certificate details.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
unclecode crawl4ai
Default version status: unaffected
0.8.7 to ≤ 0.9.5affected
pkg:pypi/crawl4aiReferences
- https://github.com/unclecode/crawl4ai/pull/2304 ↗
- https://github.com/unclecode/crawl4ai/blob/v0.9.5/crawl4ai/ssl_certificate.py ↗
- https://github.com/unclecode/crawl4ai/blob/v0.9.5/crawl4ai/async_crawler_strategy.py ↗
- https://github.com/unclecode/crawl4ai/blob/v0.9.5/deploy/docker/utils.py ↗
- https://www.vulncheck.com/advisories/crawl4ai-0.8.7-through-0.9.5-ssrf-bypass-via-sslcertificate-from-url-url-userinfo ↗