Issue Station
Sign In
Tools hereToolbox

crewai - 💡(How to fix) Fix [Security] SSRF in crewai-files FileUrl - CVE Request [1 pull requests]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

The FileUrl class in crewai-files (lib/crewai-files/src/crewai_files/core/sources.py) performs insufficient URL validation, allowing server-side requests to internal network addresses and cloud metadata endpoints (e.g., http://169.254.169.254/).

Vulnerability Type: CWE-918 (Server-Side Request Forgery)
Discoverer: IcySun ([email protected])
CVSS v3.1: 8.2 (High)
CVSS v4.0: 7.2 (High)

Root Cause

FileUrl._validate_url() only checks the URL scheme (http:///https://) without resolving DNS to validate the destination IP address. read()/aread() then calls httpx.get(url, follow_redirects=True) directly.

Notably, crewai-tools already has comprehensive SSRF protection in security/safe_path.py (validate_url() with DNS resolution and private IP detection), but this protection is not applied to crewai-files.

Fix Action

Fixed

RAW_BUFFERClick to expand / collapse

Summary

The FileUrl class in crewai-files (lib/crewai-files/src/crewai_files/core/sources.py) performs insufficient URL validation, allowing server-side requests to internal network addresses and cloud metadata endpoints (e.g., http://169.254.169.254/).

Vulnerability Type: CWE-918 (Server-Side Request Forgery)
Discoverer: IcySun ([email protected])
CVSS v3.1: 8.2 (High)
CVSS v4.0: 7.2 (High)

Impact

  • Cloud metadata exposure (AWS/GCP/Azure IAM credential theft)
  • Internal network scanning (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Local service access via 127.0.0.1/0.0.0.0

Root Cause

FileUrl._validate_url() only checks the URL scheme (http:///https://) without resolving DNS to validate the destination IP address. read()/aread() then calls httpx.get(url, follow_redirects=True) directly.

Notably, crewai-tools already has comprehensive SSRF protection in security/safe_path.py (validate_url() with DNS resolution and private IP detection), but this protection is not applied to crewai-files.

Remediation

Apply validate_url() from crewai_tools.security.safe_path in FileUrl._validate_url(), or implement equivalent IP validation. Consider disabling follow_redirects or validating redirect targets.

CVE Request

We request CVE assignment for this vulnerability.

Full report and PoC have been sent via email to the maintainer ([email protected]). Please contact [email protected] for additional details.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#ssr#request error#file not found#serialization error#model compatibility

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING