Summary
PraisonAI's SearxNG search integrations may allow an LLM-controlled URL to direct server-side requests to unintended destinations. Prompt-injected content could make the search tool probe internal services or request cloud metadata, with responses potentially exposed through agent context.
PraisonAI's SearxNG search integrations may allow an LLM-controlled URL to direct server-side requests to unintended destinations. Prompt-injected content could make the search tool probe internal services or request cloud metadata, with responses potentially exposed through agent context.
Affected context
The issue affects PraisonAI deployments using the SearxNG search tool or provider before the relevant security fix, when the search URL can be influenced by model-controlled input. Risk is higher where the application can reach internal networks, local services, or cloud metadata endpoints and returns retrieved content to agents.
The issue affects PraisonAI deployments using the SearxNG search tool or provider before the relevant security fix, when the search URL can be influenced by model-controlled input. Risk is higher where the application can reach internal networks, local services, or cloud metadata endpoints and returns retrieved content to agents.
Exploit preconditions
- Attack surface: SearxNG search functionality that performs outbound HTTP requests - Required access: Ability to influence prompts, tool inputs, or content processed by the agent - Trigger point: Construction of a search request using an attacker-influenced URL - Why exploitation is possible: The URL is sent to the HTTP client without sufficient scheme, host, port, or resolved-address validation
- Attack surface: SearxNG search functionality that performs outbound HTTP requests - Required access: Ability to influence prompts, tool inputs, or content processed by the agent - Trigger point: Construction of a search request using an attacker-influenced URL - Why exploitation is possible: The URL is sent to the HTTP client without sufficient scheme, host, port, or resolved-address validation
Why this happens
The underlying flaw is insufficient validation of a server-side request destination. The search integrations trust an LLM-controlled URL and pass it to an HTTP request function without enforcing an approved scheme, hostname, port, or network destination. This maps primarily to CWE-918, Server-Side Request Forgery, with CWE-20 reflecting the broader failure to validate input before using it in a security-sensitive operation.
The underlying flaw is insufficient validation of a server-side request destination. The search integrations trust an LLM-controlled URL and pass it to an HTTP request function without enforcing an approved scheme, hostname, port, or network destination. This maps primarily to CWE-918, Server-Side Request Forgery, with CWE-20 reflecting the broader failure to validate input before using it in a security-sensitive operation.
Potential impact
- An attacker may reach internal HTTP services that are not publicly exposed.
- The application could disclose internal JSON responses through agent context.
- Internal port availability may be inferred through request behavior.
- Cloud metadata or service credentials could be exposed where network controls permit access.
- Compromised internal services could enable further unauthorized activity.
- An attacker may reach internal HTTP services that are not publicly exposed.
- The application could disclose internal JSON responses through agent context.
- Internal port availability may be inferred through request behavior.
- Cloud metadata or service credentials could be exposed where network controls permit access.
- Compromised internal services could enable further unauthorized activity.
General mitigation guidance
Mitigation generally focuses on treating all model-controlled destinations as untrusted and limiting outbound request capability. Secure-by-default patterns include allowing only approved HTTPS schemes and trusted SearxNG hosts, validating ports and resolved addresses, blocking loopback, link-local, private, multicast, and other reserved ranges, and rechecking destinations after DNS resolution to reduce rebinding risks. Network egress restrictions, short timeouts, response-size limits, isolation of search workers, and least-privilege service identities can reduce impact. Returned content should be treated as untrusted data rather than privileged instructions, and configuration should minimize the need for user- or model-selectable URLs.
Mitigation generally focuses on treating all model-controlled destinations as untrusted and limiting outbound request capability. Secure-by-default patterns include allowing only approved HTTPS schemes and trusted SearxNG hosts, validating ports and resolved addresses, blocking loopback, link-local, private, multicast, and other reserved ranges, and rechecking destinations after DNS resolution to reduce rebinding risks. Network egress restrictions, short timeouts, response-size limits, isolation of search workers, and least-privilege service identities can reduce impact. Returned content should be treated as untrusted data rather than privileged instructions, and configuration should minimize the need for user- or model-selectable URLs.
How teams detect issues like this
Detection approaches can include static analysis for HTTP clients receiving model-, prompt-, or tool-derived URLs; code review checks for missing scheme, host, port, DNS, and private-address validation; and tests covering redirects, DNS rebinding, alternate IP representations, and blocked network ranges. Runtime monitoring can alert on requests to loopback, private, link-local, metadata, or unexpected destinations. Egress policies and automated security review tools can provide additional enforcement and visibility.
Detection approaches can include static analysis for HTTP clients receiving model-, prompt-, or tool-derived URLs; code review checks for missing scheme, host, port, DNS, and private-address validation; and tests covering redirects, DNS rebinding, alternate IP representations, and blocked network ranges. Runtime monitoring can alert on requests to loopback, private, link-local, metadata, or unexpected destinations. Egress policies and automated security review tools can provide additional enforcement and visibility.
