mendableai firecrawl up to 1.1.0 Environment Variable PROXY_SERVER server-side request forgery

Summaryinfo

A vulnerability described as critical has been identified in mendableai firecrawl up to 1.1.0. The affected element is an unknown function of the component Environment Variable Handler. The manipulation of the argument PROXY_SERVER results in server-side request forgery. This vulnerability is reported as CVE-2024-56800. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in mendableai firecrawl up to 1.1.0. Affected is an unknown code block of the component Environment Variable Handler. The manipulation of the argument PROXY_SERVER with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery (SSRF) vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address. This allowed exfiltration of local network resources through the API. The cloud service was patched on December 27th, 2024, and the maintainers have checked that no user data was exposed by this vulnerability. Scraping engines used in the open sourced version of Firecrawl were patched on December 29th, 2024, except for the playwright services which the maintainers have determined to be un-patchable. All users of open-source software (OSS) Firecrawl should upgrade to v1.1.1. As a workaround, OSS Firecrawl users should supply the playwright services with a secure proxy. A proxy can be specified through the `PROXY_SERVER` env in the environment variables. Please refer to the documentation for instructions. Ensure that the proxy server one is using is setup to block all traffic going to link-local IP addresses.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-56800 since 12/30/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.1.1 eliminates this vulnerability. Applying the patch 4d1f92f4c8c36403022428285a03621fd90d62ec is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• mendableai

Name

• firecrawl

Version

• 1.0
• 1.1.0

License

• open-source

Website

• Product: https://github.com/mendableai/firecrawl/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion