GHSA-qj9c-59p6-8cgx: High severity pip/praisonai vulnerability
Summary
PraisonAI's AgentMail bot, when run in webhook (or hybrid) mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the attacker-controlled request body, so any network peer can inject messages into the agent with a spoofed sender (bypassing sender allow/block lists) and have the agent process the content and reply to an attacker-chosen address. Sibling bots (linear.py, whatsapp.py) fail closed when no secret is configured; AgentMail omits the check entirely. Runtime-confirmed; severity Medium.
Details
Affected component - Package: praisonai 4.6.63. File: src/praisonai/praisonai/bots/agentmail.py (AgentMailBot, webhook/hybrid mode).
Vulnerable code / root cause
Path: src/praisonai/praisonai/bots/agentmail.py
Function: startwebhookmode / handleemailwebhook / handlemessage
Snippet: python startwebhookmode: binds all interfaces self.webhooksite = web.TCPSite(self.webhookrunner, "0.0.0.0", self.webhookport)
handleemailwebhook: no signature/HMAC check, no auth body = await request.json() if body.get("type") != "message.received": return web.Response(status=200, text="OK") asyncio.createtask(self.processwebhookpayload(body)) # dispatch attacker body return web.Response(status=200, text="OK")
handlemessage: agent processes content, replies to attacker-controlled sender response = await self.session.chat(self.agent, senderid, body, ...) await self.sendmessage(channelid=senderid, ...) Issue: attacker-controlled input is the raw webhook JSON (from, extractedtext, subject). The guard that should exist is provider signature verification — there is none here (no svix/HMAC, no webhooksrequireverification() call). The sink is self.session.chat(self.agent, ...) (agent invocation) and sendmessage(channelid=senderid, ...) (reply to the spoofed sender). Sibling handlers src/praisonai/praisonai/bots/linear.py and bots/whatsapp.py call webhooksrequireverification() and reject when no secret is set — AgentMail does not, so it fails open.
Attack flow 1. Operator runs the AgentMail bot in webhook/hybrid mode (documented; binds 0.0.0.0, default path /webhook, default port 8080). 2. Attacker POSTs a crafted message.received event with a spoofed from and arbitrary extractedtext. 3. The agent processes the content; any reply is sent to the attacker-chosen senderid.
Why existing protection is bypassed There is no protection on this handler: no signature verification, no webhooksrequireverification() gate, no auth. Sender allow/block lists are bypassed because from is attacker-controlled.
Security boundary Unauthenticated network peer → agent message pipeline + reply destination. Crosses the bot's inbound trust boundary (provider webhooks are expected to be signed/authenticated).
Proof of Concept
Environment Real AgentMailBot.handleemailwebhook mounted in a local runtime (127.0.0.1:18080); the agent layer is a canary recorder (/webhook-log). No real email is sent. Runnable assets: PraisonAI-Runtime-Repro\runtime-files\.
Steps to reproduce 1. PRAI-03-01-Webhook-Spoofed-Sender: http POST /webhook HTTP/1.1 Host: 127.0.0.1:18080 Content-Type: application/json
{"type":"message.received","data":{"from":"attacker@evil.example","extractedtext":"PRAISONAIWEBHOOKINJECTCANARY7f3a91 ...","subject":"hello","headers":{}}} 2. PRAI-03-02-Agent-Reached-Response: GET /webhook-log.
Expected result The webhook should reject unsigned/unauthenticated events; spoofed senders should not reach the agent.
Actual result - POST /webhook → 200 OK (no auth/signature). - GET /webhook-log → {"reachedagent":[{"sender":"attacker@evil.example","content":"...PRAISONAIWEBHOOKINJECTCANARY7f3a91...","source":"webhook"}],"count":1}.
Impact Unauthenticated message injection into the agent; sender spoofing (access-control bypass); agent reply/exfiltration to an attacker-chosen address; prompt-injection surface; LLM cost abuse. If the agent has dangerous tools, escalation via prompt injection is possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/praisonaito a version that resolves this vulnerability.Fixed in 4.6.78 - Configuration
Require webhook signature/HMAC verification and reject requests when no webhook secret is configured, as sibling bots do; unsigned or unauthenticated message.received events must not reach the agent.
PraisonAI AgentMail bot webhook webhooks_require_verification = enabled
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using PraisonAI's AgentMailBot in webhook or hybrid mode are exposed. The affected component is identified as praisonai 4.6.63, where the webhook server binds to 0.0.0.0.
What does an attacker need to exploit this issue?
An attacker only needs network access to the webhook listener. No credentials, authentication, signature, or HMAC verification is required.
Do sender allowlists or blocklists prevent exploitation?
No. The sender address is taken from the attacker-controlled request body, allowing an attacker to spoof a sender and bypass sender allow/block lists.
What can an attacker cause after sending a forged event?
They can inject a message for the agent to process and direct the bot's reply to an address chosen by the attacker. The injected content is also attacker-controlled.
How can I determine whether an instance is affected?
Check whether the deployment uses AgentMailBot in webhook or hybrid mode and whether its webhook listener is reachable on the configured port. The vulnerable implementation starts the listener on all interfaces using 0.0.0.0.