Description
Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, retrieving cloud metadata and internal resources through the scrape API.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Firecrawl Firecrawl
Default version status: unaffected
0 to < 2.11.586affected
References
- https://github.com/firecrawl/firecrawl/issues/5256 ↗
- https://github.com/firecrawl/firecrawl ↗
- https://github.com/firecrawl/firecrawl/blob/5c198a7d9376fef21a7f6d74313fc957842744ad/apps/playwright-service-ts/api.ts#L47-L117 ↗
- https://github.com/firecrawl/firecrawl/commit/5e74ff37b41ac650d6bccff170a9be0a6decb946 ↗
- https://www.vulncheck.com/advisories/firecrawl-before-2.11.586-ssrf-protection-bypass-via-dns-rebinding-in-playwright-service ↗