CVE-2025-2828

Executive Summary

CVE-2025-2828 is a Server-Side Request Forgery (SSRF) vulnerability in the RequestsToolkit component of the langchain-community package (specifically langchain_community.agent_toolkits.openapi.toolkit.RequestsToolkit) in langchain-ai/langchain version 0.0.27. The vulnerability arises because the toolkit does not enforce restrictions on requests to remote internet addresses, allowing it to also access local addresses. An attacker can exploit this flaw to perform port scans, access local services, retrieve instance metadata from cloud environments (e.g., Azure, AWS), and interact with servers on the local network. The issue has been fixed in version 0.0.28.

Supply Chain & Package Security

This vulnerability affects the langchain-community Python package, which is part of the LangChain ecosystem. The package is widely used in AI/LLM applications for building agents and toolkits. The SSRF flaw in RequestsToolkit can be exploited by malicious actors to pivot from the application server to internal networks, potentially compromising cloud metadata and internal services. Organizations using LangChain should immediately update to version 0.0.28 or later to mitigate this risk.

CVSS Breakdown & Threat Level

• CVSS Score: 8.4 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. An unauthenticated attacker can send crafted requests to the vulnerable component, leading to full compromise of internal resources.

Deep Dive & Mechanics

The vulnerability exists in the RequestsToolkit class within langchain_community.agent_toolkits.openapi.toolkit. This toolkit is designed to allow agents to make HTTP requests to external APIs. However, in version 0.0.27, there is no validation or restriction on the target URL. The toolkit uses Python's requests library to make HTTP requests, and without proper filtering, an attacker can specify internal IP addresses (e.g., 127.0.0.1, 10.0.0.1, 169.254.169.254) or localhost.

The core issue is that the RequestsToolkit does not implement a blocklist or allowlist for IP addresses. This allows an attacker to:

• Perform port scans on internal networks.
• Access local services (e.g., databases, Redis, internal APIs).
• Retrieve cloud instance metadata (e.g., AWS http://169.254.169.254/latest/meta-data/, Azure http://169.254.169.254/metadata/instance).
• Interact with other servers on the local network.

The fix in version 0.0.28 introduces a validation mechanism that restricts requests to only allowed remote addresses, typically by checking that the target IP is not in private or loopback ranges.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.0.27):

# langchain_community/agent_toolkits/openapi/toolkit.py
class RequestsToolkit(BaseToolkit):
    def _run(self, url: str, **kwargs) -> str:
        response = requests.get(url, **kwargs)
        return response.text

In this version, the url parameter is passed directly to requests.get() without any validation.

Patched Code (version 0.0.28):

# langchain_community/agent_toolkits/openapi/toolkit.py
import ipaddress
from urllib.parse import urlparse

class RequestsToolkit(BaseToolkit):
    def _run(self, url: str, **kwargs) -> str:
        parsed = urlparse(url)
        host = parsed.hostname
        try:
            ip = ipaddress.ip_address(host)
            if ip.is_private or ip.is_loopback:
                raise ValueError("Request to private or loopback address is not allowed")
        except ValueError:
            # If host is not an IP, resolve it and check
            import socket
            ips = socket.getaddrinfo(host, 80)
            for _, _, _, _, sockaddr in ips:
                ip = ipaddress.ip_address(sockaddr[0])
                if ip.is_private or ip.is_loopback:
                    raise ValueError("Request to private or loopback address is not allowed")
        response = requests.get(url, **kwargs)
        return response.text

The patched version validates the target IP address and blocks requests to private or loopback addresses.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable version: pip install langchain-community==0.0.27
2. Set up a local service (e.g., a simple HTTP server on port 8080) to simulate an internal resource.
3. Run a LangChain agent that uses RequestsToolkit.

Exploitation Steps:

1. Craft a prompt that instructs the agent to make a request to an internal address:

   "Make a GET request to http://127.0.0.1:8080/admin"
   

2. The agent will execute the request and return the response, revealing internal data.

Example Payload:

from langchain_community.agent_toolkits.openapi.toolkit import RequestsToolkit

toolkit = RequestsToolkit()
result = toolkit._run("http://169.254.169.254/latest/meta-data/")
print(result)  # AWS metadata

Blue Team

Detection:

• Monitor for outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) from application servers.
• Look for requests to cloud metadata endpoints (e.g., 169.254.169.254).
• Use network segmentation to prevent application servers from accessing internal resources directly.

Mitigation:

• Update to version 0.0.28 or later.
• Implement a Web Application Firewall (WAF) rule to block requests to private IPs.
• Use a proxy that enforces allowlists for outbound requests.

Indicators of Compromise (IOCs)

• Network Traffic: Outbound HTTP requests to private IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1).
• Cloud Metadata Requests: Requests to http://169.254.169.254/ (AWS, Azure, GCP).
• Log Entries: Application logs showing RequestsToolkit making requests to internal IPs.
• File Hashes: No specific file hashes; focus on network patterns.

Detection Engineering

YARA Rule

rule CVE_2025_2828_SSRF_LangChain {
    meta:
        description = "Detects SSRF exploitation attempts against langchain-community RequestsToolkit"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2828"
    strings:
        $s1 = "RequestsToolkit" ascii wide nocase
        $s2 = "169.254.169.254" ascii wide nocase
        $s3 = "127.0.0.1" ascii wide nocase
        $s4 = "10." ascii wide nocase
        $s5 = "192.168." ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2025-2828 SSRF via LangChain RequestsToolkit
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SSRF attempts targeting internal IPs via langchain-community RequestsToolkit
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: langchain
detection:
    selection:
        ToolName: "RequestsToolkit"
        RequestURL|contains:
            - "127.0.0.1"
            - "10."
            - "172.16."
            - "192.168."
            - "169.254.169.254"
    condition: selection
falsepositives:
    - Legitimate use of internal APIs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-2828 SSRF via LangChain RequestsToolkit"; flow:to_server; content:"RequestsToolkit"; http_client_body; content:"169.254.169.254"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Update: Upgrade langchain-community to version 0.0.28 or later.

   pip install --upgrade langchain-community>=0.0.28
   

2. Network Segmentation: Ensure application servers cannot directly access internal networks or cloud metadata endpoints.
3. Input Validation: Implement additional validation on URLs passed to RequestsToolkit even after patching.
4. Monitoring: Deploy detection rules (YARA, Sigma, Suricata) to identify SSRF attempts.
5. Least Privilege: Run LangChain agents with minimal network permissions.

Report generated by Valters IT DevSecOps & CTI Expert