CVE-2024-0243: Server-side Request Forgery In Recursive URL Loader
With the following crawler configuration:
python from bs4 import BeautifulSoup as Soup
url = "https://example.com" loader = RecursiveUrlLoader( url=url, maxdepth=2, extractor=lambda x: Soup(x, "html.parser").text ) docs = loader.load()
An attacker in control of the contents of https://example.com could place a malicious HTML file in there with links like "https://example.completely.different/myfile.html" and the crawler would proceed to download that file as well even though preventoutside=True.
https://github.com/langchain-ai/langchain/blob/bf0b3cc0b5ade1fb95a5b1b6fa260e99064c2e22/libs/community/langchaincommunity/documentloaders/recursiveurlloader.py#L51-L51
Resolved in https://github.com/langchain-ai/langchain/pull/15559
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0243?
CVE-2024-0243 has been rated as a critical vulnerability due to its potential impact on web application security.
How do I fix CVE-2024-0243?
To fix CVE-2024-0243, upgrade to version 0.1.0 or later of the langchain package.
What types of software are affected by CVE-2024-0243?
CVE-2024-0243 affects the langchain package below version 0.1.0.
What is the exploit mechanism for CVE-2024-0243?
CVE-2024-0243 can be exploited through crafted URLs that an attacker controls to affect the web crawler behavior.
Is CVE-2024-0243 remotely exploitable?
Yes, CVE-2024-0243 is remotely exploitable, allowing attackers to compromise the application from a distance.