CVE-2024-3095

Executive Summary

CVE-2024-3095 is a Server-Side Request Forgery (SSRF) vulnerability in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The flaw allows an attacker to force the server to make requests to internal or local addresses, enabling port scanning, access to local services, and potential reading of cloud instance metadata. This can lead to credential theft and state-changing interactions with internal APIs. The vulnerability is limited to GET requests, but the impact on confidentiality and integrity is significant.

Supply Chain & Package Security

This vulnerability affects the Python package langchain (PyPI). Users of this package in supply chain environments should immediately assess their exposure, as the Web Research Retriever component may be used in automated pipelines or AI-driven applications that interact with internal networks.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the potential for internal network reconnaissance and data exfiltration, though exploitation is limited to GET requests.

Deep Dive & Mechanics

The Web Research Retriever in langchain 0.1.5 is designed to fetch web content for AI processing. It fails to validate or restrict the target URLs, allowing an attacker to supply internal IP addresses (e.g., 127.0.0.1, 10.0.0.1) or cloud metadata endpoints (e.g., http://169.254.169.254/). The server then makes GET requests to these addresses, returning the response data to the attacker. This can be used to:

• Scan internal ports and services.
• Access local services (e.g., databases, admin panels).
• Read cloud instance metadata (e.g., AWS, GCP, Azure).
• Use the server as a proxy for web attacks on third parties.

The vulnerability is limited to GET requests, so POST-based attacks are not possible, but the information gained can lead to further compromise.

Vulnerable vs. Patched Code

Vulnerable Code (langchain 0.1.5):

# In web_research_retriever.py
def fetch_url(url):
    response = requests.get(url)
    return response.text

No validation of the URL is performed.

Patched Code (hypothetical):

# In web_research_retriever.py
import ipaddress
from urllib.parse import urlparse

def fetch_url(url):
    parsed = urlparse(url)
    host = parsed.hostname
    try:
        ip = ipaddress.ip_address(host)
        if ip.is_private:
            raise ValueError("Private IP not allowed")
    except ValueError:
        pass
    response = requests.get(url)
    return response.text

The patched version checks if the hostname resolves to a private IP and blocks the request.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy langchain 0.1.5 with the Web Research Retriever enabled.
2. Exploit: Send a request to the retriever with a URL pointing to an internal service, e.g., http://127.0.0.1:8080/admin or http://169.254.169.254/latest/meta-data/.
3. Result: The server will fetch the internal resource and return its content.

Example Payload:

curl -X POST "http://target:8000/retrieve" -d '{"url": "http://169.254.169.254/latest/meta-data/"}'

Blue Team

1. Detection: Monitor outbound HTTP requests from the langchain server to internal IP ranges.
2. Mitigation: Implement network segmentation to prevent the server from accessing internal resources.
3. Harden: Apply input validation to block private IPs and metadata endpoints.

Indicators of Compromise (IOCs)

• Network: Outbound GET requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) or cloud metadata IPs (169.254.169.254).
• Logs: Unusual URLs in Web Research Retriever logs containing internal IPs or metadata endpoints.
• Process: langchain process making connections to internal addresses.

Detection Engineering

YARA Rule

rule CVE_2024_3095_SSRF {
    meta:
        description = "Detects SSRF attempts targeting internal IPs in langchain"
        author = "Valters IT"
        date = "2024-10-01"
    strings:
        $ip1 = "127.0.0.1"
        $ip2 = "169.254.169.254"
        $ip3 = "10." ascii
        $ip4 = "192.168." ascii
        $ip5 = "172.16." ascii
    condition:
        any of ($ip*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-3095 SSRF Attempt via Web Research Retriever
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts targeting internal IPs in langchain
author: Valters IT
logsource:
    category: webserver
    product: langchain
detection:
    selection:
        c-uri|contains:
            - "127.0.0.1"
            - "169.254.169.254"
            - "10."
            - "192.168."
            - "172.16."
    condition: selection
falsepositives:
    - Legitimate internal monitoring
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3095 SSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"127.0.0.1" within:100; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-3095 SSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"169.254.169.254" within:100; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-3095 SSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"10." within:100; sid:1000003; rev:1;)
alert http any any -> any any (msg:"CVE-2024-3095 SSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"192.168." within:100; sid:1000004; rev:1;)
alert http any any -> any any (msg:"CVE-2024-3095 SSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"172.16." within:100; sid:1000005; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Web Research Retriever component if not in use.
2. Network: Implement egress filtering to block outbound requests to private IP ranges from the langchain server.
3. Code: Apply input validation to reject URLs pointing to private or loopback addresses.
4. Monitor: Deploy detection rules (YARA, Sigma, Suricata) to alert on SSRF attempts.
5. Patch: Monitor for official patches from langchain-ai and apply when available.

Valters IT
DevSecOps & Cyber Threat Intelligence