Cloudanix VulnDB

CVE-2024-3095

Medium · 4.8

CVSS

4.8

EPSS

0.7%

Published

Jun 6, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a popular AI software library lets attackers reach internal company systems through the AI tool when it searches the web, potentially exposing sensitive data until the library is updated.

Chainable
Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
High
Impact
Data Exposure
Component
Library
Class
SSRF
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Server-Side Request Forgery in the Web Research Retriever allows unauthenticated or low-privileged callers to issue GET requests to arbitrary internal URLs, enabling port scanning, access to local services, retrieval of cloud instance metadata, and potential state-changing interactions with internal APIs.

Why it matters to the business

Organizations using LangChain for AI applications face risk of internal network exposure, credential theft, and possible escalation to code execution when the component processes untrusted input, increasing operational and compliance exposure until patched.

How an attack unfolds

An attacker supplies a crafted URL or query to the Web Research Retriever; the component issues an outbound GET request without address filtering, allowing the attacker to reach internal endpoints, read responses, and potentially abuse the server as a proxy for further attacks.

How to fix it

Upgrade hwchase17/langchain to commit 24e9b48d157c43c1faf2820c6b302c1311a3cadf or later; restrict the Web Research Retriever to approved external domains via configuration or network controls; disable the component if web research is not required.

How to confirm the fix worked

Confirm the installed LangChain commit is at or beyond 24e9b48d157c43c1faf2820c6b302c1311a3cadf; test by attempting retrieval of a known internal-only endpoint and verifying it is blocked; review application logs for unexpected internal request patterns.

Typical attack path

  1. Locate an application exposing the LangChain Web Research Retriever endpoint or accepting user-controlled URLs for web research
  2. Submit a request containing an internal target URL (e.g., localhost, metadata service, or adjacent host)
  3. Observe returned response data or side effects confirming reachability
  4. Iterate to scan ports, read service content, or trigger state-changing internal operations

How to detect it

Review application and web-server logs for requests containing internal IP addresses or metadata endpoints originating from LangChain processes; inspect outbound traffic for unexpected GETs to RFC1918 ranges or cloud metadata services.

What your security team should do

  • Immediately inventory all deployments using LangChain and prioritize upgrade to the fixed commit
  • Apply network egress controls or URL allow-lists around the Web Research Retriever until patched
  • Monitor for unusual outbound requests from LangChain processes to internal addresses

The record

A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This flaw enables attackers to execute port scans, access local services, and in some scenarios, read instance metadata from cloud environments. The vulnerability is particularly concerning as it can be exploited to abuse the Web Explorer server as a proxy for web attacks on third parties and interact with servers in the local network, including reading their response data. This could potentially lead to arbitrary code execution, depending on the nature of the local services. The vulnerability is limited to GET requests, as POST requests are not possible, but the impact on confidentiality, integrity, and availability is significant due to the potential for stolen credentials and state-changing interactions with internal APIs.

Affected packages

Ecosystem Package Introduced Fixed
PyPI langchain-community 0 0.2.9

Related vulnerabilities