GHSA-qvg9-vp87-h3hr

ghsaUSosv

composio Server-Side Request Forgery (SSRF) vulnerability

view advisory published 2025-03-20Licence: CC-BY-4.0

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-8952US	high7.5	0.73% (54th)	—	2025-03-20
A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. T…

references

External citations — patches, advisories, analysis.

https://github.com/ComposioHQ/composioPACKAGE
https://huntr.com/bounties/d1acdd38-10d7-45df-9df0-9fc71f0e1c2aWEB
https://nvd.nist.gov/vuln/detail/CVE-2024-8952ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan