Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-55525, describes an SSRF issue in PraisonAI's web_crawl function due to redirect-following without revalidation. The analysis of the provided commit 2f9677abb2ea68eab864ee8b6a828fd0141612e1 confirms this. The patch modifies src/praisonai-agents/praisonaiagents/tools/web_crawl_tools.py in two key areas:
web_crawl function: In the vulnerable version, this function performed an initial validation of the URL but then passed it to _crawl_with_httpx. The critical flaw was that this initial validation was not sufficient to cover subsequent redirects. The patch removes the old, insufficient validation logic and integrates a new _is_safe_crawl_url check, ensuring that only safe URLs are processed.
_crawl_with_httpx function: This function was directly responsible for making the HTTP requests. In the vulnerable state, it used httpx.Client(follow_redirects=True). This meant that any redirects issued by the initial URL would be automatically followed by httpx without any further security checks on the redirect destination. The fix explicitly disables follow_redirects and implements a manual redirect loop. Crucially, within this loop, each redirect target is now explicitly validated using the new _is_safe_crawl_url function before the request is made. This prevents the client from being redirected to internal or restricted network addresses.
The _is_safe_crawl_url function itself is a mitigation introduced by the patch and not a vulnerable function. The vulnerability existed in the absence of such a check within _crawl_with_httpx and the insufficient validation within web_crawl that allowed the unvalidated redirect to occur. Exploitation would involve providing a URL to web_crawl that, upon fetching by _crawl_with_httpx, issues a redirect to a sensitive internal resource (e.g., 127.0.0.1, cloud metadata endpoints).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| praisonaiagents | pip | < 1.6.58 | 1.6.58 |
