Server-side Request Forgery (SSRF) Affecting composio-core package, versions [0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-COMPOSIOCORE-9637813
- published3 Apr 2025
- disclosed20 Mar 2025
- creditHaiNguyen
Introduced: 20 Mar 2025
NewCVE-2024-8952 (opens in a new tab)How to fix?
There is no fixed version for composio-core.
Overview
composio-core is a Core package to act as a bridge between composio platform and other services.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. An attacker with high privileges can read files, access AWS metadata, and interact with local services on the system by sending crafted requests to the affected endpoint.