Langchain-AI Web Research Retriever Vulnerable to SSRF Attacks

CVE-2024-3095

What is CVE-2024-3095?

A vulnerability exists in the Web Research Retriever component of langchain-ai's langchain, specifically in version 0.1.5. This flaw is classified as a Server-Side Request Forgery (SSRF), enabling attackers to forge requests that can reach local addresses due to a lack of request restrictions. Such a vulnerability could be exploited to execute port scans, access sensitive local services, and interact with cloud instance metadata. Although attacks are limited to GET requests, the implications are severe, including potential unauthorized access to internal API responses and exposure of confidential information. The ability to leverage the Web Explorer server as a proxy for web attacks on third-party sites further heightens the risk, facilitating serious impacts on data integrity and security.

References