Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check
Summary
The Docker API server applied its SSRF destination check to the crawl target URL only, not to the proxy address. An unauthenticated request could supply a proxy pointing at an internal IP and route the browser through it, reaching internal services and cloud-metadata endpoints, while using a perfectly valid crawl URL. The Docker API is unauthenticated by default.
Affected paths
/crawl, /crawl/stream, and /crawl/job accept a browser_config (and crawler_config). The following all feed Chromium's egress and were unchecked:
browser_config.proxy_config.serverbrowser_config.proxy(deprecated field)crawler_config.proxy_config.server--proxy-server/--proxy-pac-url/--proxy-bypass-list/--host-resolver-rulesflags inbrowser_config.extra_args
Attack
An attacker sends /crawl with a benign, validation-passing URL but a proxy_config.server pointing at an internal IP. Chromium routes all requests through that proxy. For plain-HTTP targets the proxy receives the full request and can return any content, which is then returned verbatim in the crawl result (results[0].html / cleaned_html / markdown). In a real deployment the proxy would be an attacker-controlled server pointing at cloud metadata (e.g. AWS IMDSv1 at 169.254.169.254) to retrieve IAM credential tokens.
Impact
Unauthenticated server-side request forgery to internal services and cloud-metadata endpoints, with the response returned to the attacker.
Fix
Every proxy destination is validated with the same global-routability check used for crawl URLs (reject any resolved address that is not is_global, including IPv6 transition forms) before the browser is constructed; proxy/DNS-redirecting flags are stripped from extra_args. A legitimate public proxy still works. Honors CRAWL4AI_ALLOW_INTERNAL_URLS.
Workarounds
- Upgrade to the patched version (0.8.9).
- Enable authentication (
CRAWL4AI_API_TOKEN). - Restrict the container's outbound network access (egress firewall / no metadata route).
Credits
Geo (geo-chen) - reported the proxy_config.server SSRF with a clear PoC.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | crawl4ai | < 0.8.9 | 0.8.9 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N- Debilidad (CWE)
CWE-918- Plataforma
- Python (PyPI)
- Paquete
crawl4ai- Publicada
- 16.06.2026
- Actualizado
- 11.10.2026 14:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-588 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-6qhc-x826-342c - CC BY 4.0
Historial de vulnerabilidades: crawl4ai
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 12
- Primera → última
- 04.2025 06.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 6
- Alta 5
- Media 1
Divulgaciones por año
- 2025: 1
- 2026: 11
-
Crawl4AI: SSRF via proxy settings in the Docker server bypasses the crawl-URL SSRF check esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.