CVE-2024-0243

Executive Summary

CVE-2024-0243 is a Server-Side Request Forgery (SSRF) vulnerability in the LangChain RecursiveUrlLoader component. The flaw allows an attacker who controls the content of a target website to craft malicious HTML links that bypass the prevent_outside=True security check. By using a specially crafted URL that appears to be within the same domain but actually points to an external resource (e.g., https://example.completely.different/my_file.html), the crawler will follow the link and download content from an attacker-controlled server. This can lead to data exfiltration, internal network scanning, or other SSRF-based attacks.

The vulnerability is rated with a CVSS score of 3.7 (Low), but its impact is amplified in environments where LangChain is used to crawl internal or sensitive resources. The patch was merged in pull request #15559, but no official release version has been confirmed as patched.

Supply Chain & Package Security

This vulnerability affects the langchain-community Python package, specifically the recursive_url_loader module. Organizations using LangChain in production should immediately review their dependency versions and apply the patch from the upstream repository. The package is distributed via PyPI, and supply chain risks include malicious forks or compromised dependencies that could exploit this flaw.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can exploit this remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker-controlled resource are separate.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): Low (L) – The attacker can inject external content into the crawl results.
• Availability (A): None (N) – No denial of service.

Overall CVSS Score: 3.7 (Low)

Threat Level: Low, but with potential for escalation in internal network scenarios.

Deep Dive & Mechanics

The vulnerability lies in the URL validation logic of RecursiveUrlLoader. The prevent_outside=True parameter is intended to restrict crawling to URLs that share the same base domain as the initial URL. However, the validation only checks if the target URL starts with the base URL string. This allows an attacker to craft a URL like https://example.completely.different/my_file.html which, when parsed, is actually a subdomain of completely.different but the string https://example.com is a prefix of the full URL. The loader incorrectly treats it as internal.

The vulnerable code path is in libs/community/langchain_community/document_loaders/recursive_url_loader.py at line 51. The fix in PR #15559 likely involves proper URL parsing using urllib.parse to extract the netloc and compare it against the allowed domain.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

def _check_url(url, base_url):
    if prevent_outside and not url.startswith(base_url):
        raise ValueError("URL is outside allowed domain")
    return True

Patched Code (conceptual):

from urllib.parse import urlparse

def _check_url(url, base_url):
    if prevent_outside:
        parsed_url = urlparse(url)
        parsed_base = urlparse(base_url)
        if parsed_url.netloc != parsed_base.netloc:
            raise ValueError("URL is outside allowed domain")
    return True

The patched version uses proper URL parsing to compare the network location (netloc) rather than a simple string prefix check.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A publicly accessible web server controlled by the attacker.
• The target must be running LangChain with RecursiveUrlLoader configured to crawl a URL the attacker controls.

Exploitation Steps:

1. Set up a malicious HTML page on https://attacker.com/malicious.html containing:

   <a href="https://attacker.completely.different/steal_data.html">Click here</a>
   

2. Configure the target LangChain instance to crawl https://attacker.com/malicious.html with prevent_outside=True.
3. The crawler will follow the link to https://attacker.completely.different/steal_data.html (which is actually attacker.completely.different), downloading content from the attacker's server.
4. The attacker can serve arbitrary content, including scripts that exfiltrate data or probe internal networks.

Lab Setup:

• Use a local Python environment with LangChain installed.
• Create a simple HTTP server to serve the malicious HTML.
• Run the vulnerable RecursiveUrlLoader against the local server.

Blue Team

Detection:

• Monitor for unusual outbound HTTP requests from LangChain processes to unexpected domains.
• Look for URL patterns where the domain appears to be a subdomain of a legitimate site but is actually a different registered domain (e.g., example.completely.different).

Hunting:

• Search logs for RecursiveUrlLoader activity and inspect the URLs being crawled.
• Use network flow data to identify connections to domains that are not part of the expected crawl scope.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to domains that are subdomains of a legitimate domain but resolve to different IPs.
  • Unusual patterns in URL paths that include the base domain as a prefix (e.g., https://legitimate.completely.different/path).
• File:
  • Log entries showing RecursiveUrlLoader crawling URLs with mismatched netloc.
• Behavioral:
  • LangChain processes making requests to external servers not listed in the initial crawl configuration.

Detection Engineering

YARA Rule

rule CVE_2024_0243_LangChain_SSRF {
    meta:
        description = "Detects vulnerable RecursiveUrlLoader code pattern"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0243"
    strings:
        $vuln_pattern = "prevent_outside" nocase
        $url_startswith = "startswith" nocase
    condition:
        all of them
}

Sigma Rule

title: LangChain RecursiveUrlLoader SSRF Attempt
id: 8f9a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects attempts to exploit CVE-2024-0243 by crawling URLs with mismatched domains
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains: 'RecursiveUrlLoader'
    condition: selection
falsepositives:
    - Legitimate use of RecursiveUrlLoader with complex URLs
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0243 LangChain SSRF Attempt"; flow:to_server; content:"RecursiveUrlLoader"; http_client_body; pcre:"/https?:\/\/[a-zA-Z0-9.-]+\.(com|org|net)\/[a-zA-Z0-9\/._-]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Apply the fix from PR #15559 by updating the langchain-community package to the latest version that includes the patch.
2. Workaround: If patching is not possible, avoid using prevent_outside=True or implement a custom URL validation function that uses proper URL parsing.
3. Network Controls: Restrict outbound HTTP traffic from LangChain processes to only allow connections to known, trusted domains.
4. Monitoring: Enable logging for all HTTP requests made by LangChain and alert on any requests to unexpected domains.
5. Input Validation: Sanitize and validate all URLs before passing them to RecursiveUrlLoader.

Valters IT
DevSecOps & Cyber Threat Intelligence