CVE-2026-55525

### Summary `web_crawl` (an exported, model-callable tool) validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with `httpx.Client(follow_redirects=True)` and never re-validates redirect targets. An attacker who controls the agent's crawl target (a malicious task, or prompt injection inside any page the agent already crawls) supplies a public URL that HTTP 302-redirects to an internal address. httpx follows the redirect, fetches the internal resource (cloud metadata `169.254.169.254`, localhost services, internal APIs), and returns its body into the agent context. This bypasses the SSRF protection added to fix the earlier web_crawl SSRF reports, so it is an incomplete fix for that class. httpx is the default crawl provider on a stock `pip install praisonaiagents`, so no provider configuration is required. ### Details 1. The agent is asked (or prompt-injected) to crawl `https://attacker.example/r`, which the source accepts because `attacker.example` resolves to a public IP. 2. The attacker server responds 302 Location: `http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>`. 3. `_crawl_with_httpx` follows the redirect with `follow_redirects=True`, fetches the IAM credential document, and `web_crawl` returns it in the result content field, where it enters the agent context and any downstream tool, log, or model response. The same technique reaches `http://127.0.0.1:<port>/` internal services and other link-local and RFC1918 hosts **Source (validates only the initial hostname)** ```python # src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py:231 ip_str = socket.gethostbyname(hostname) ip = ipaddress.ip_address(ip_str) if ip.is_loopback or ip.is_private or ip.is_link_local or ip.is_multicast or ip.is_unspecified: logger.warning(f"Rejected SSRF or private IP attempt: {u}") continue ``` **Sink (follows redirects with no re-validation)** ```python # src/praisonai-agents/praisonaiagen