CVE-2024-3095 Overview
CVE-2024-3095 is a Server-Side Request Forgery (SSRF) vulnerability in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The retriever fails to restrict outbound HTTP requests to remote internet addresses, allowing attackers to target local and internal network resources. Attackers can abuse the retriever to perform port scans, reach internal services, and read cloud instance metadata endpoints. The flaw is classified under CWE-918 and affects applications that expose LangChain's Web Research Retriever to untrusted input.
Critical Impact
Attackers can pivot through vulnerable LangChain deployments to reach internal services, extract cloud instance metadata credentials, and use the host as a proxy for attacks against third parties.
Affected Products
- langchain-ai/langchain version 0.1.5
- Applications embedding the Web Research Retriever component
- Cloud-deployed LangChain services with access to internal networks or metadata endpoints
Discovery Timeline
- 2024-06-06 - CVE-2024-3095 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-3095
Vulnerability Analysis
The Web Research Retriever accepts URLs and issues HTTP GET requests server-side to fetch content for downstream language-model processing. The component lacks allowlisting or address-family filtering, so attacker-supplied URLs can point at loopback, RFC1918, link-local, or cloud metadata addresses. When the server dereferences these URLs, the retriever returns response bodies to the attacker context, exposing internal service data.
Exploitation is restricted to HTTP GET requests, since the retriever does not issue POST traffic. Despite this constraint, GET-based interactions with internal APIs can trigger state changes, disclose sensitive tokens, and enable credential theft from cloud metadata services such as 169.254.169.254. Depending on which local services respond, the attacker may reach code execution surfaces exposed on the loopback interface.
Root Cause
The root cause is missing validation of destination hosts before the retriever performs outbound requests. The component does not resolve target hostnames and reject private, loopback, link-local, or metadata IP ranges. This absence of network egress restriction places the vulnerability squarely within CWE-918: Server-Side Request Forgery.
Attack Vector
An authenticated user submits a URL that resolves to an internal address. The Web Research Retriever, running with the trust boundary of the application server, issues the GET request and returns the response body. Attackers use this primitive to enumerate internal ports, read cloud metadata credentials, and interact with unauthenticated internal APIs. The retriever effectively becomes a network proxy inside the victim's perimeter.
Refer to the Huntr Bounty Report for the disclosed technical details.
Detection Methods for CVE-2024-3095
Indicators of Compromise
- Outbound HTTP GET requests from the LangChain application host to RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254.
- Unexpected access to cloud instance metadata service (IMDS) endpoints from application processes.
- Anomalous sequential requests to internal IPs and ports indicative of port scanning behavior.
- User-submitted retriever queries containing internal IP literals, localhost, or metadata hostnames.
Detection Strategies
- Instrument the Web Research Retriever to log every outbound URL and destination IP, and alert on non-public destinations.
- Inspect application logs for retriever invocations that resolve to private address space or metadata IPs.
- Correlate egress network flows with LangChain process identifiers to isolate SSRF traffic patterns.
Monitoring Recommendations
- Enforce network policy logging on egress from LangChain workloads and forward flow logs to a central analytics platform.
- Monitor cloud IMDS access metrics. On AWS, require IMDSv2 and alert on IMDSv1 requests from application roles.
- Track version metadata of installed langchain packages across build pipelines and runtime hosts.
How to Mitigate CVE-2024-3095
Immediate Actions Required
- Upgrade langchain to a version later than 0.1.5 that addresses the SSRF condition in the Web Research Retriever.
- Restrict egress from LangChain workloads to an allowlist of required external domains.
- Enforce IMDSv2 with hop-limit 1 on cloud instances running LangChain to block metadata theft via SSRF.
- Remove or gate the Web Research Retriever behind server-side URL validation when untrusted input can reach it.
Patch Information
No vendor advisory URL is listed in the NVD record for this CVE. Consult the Huntr Bounty Report and the langchain-ai/langchain release notes for fixed versions and remediation guidance.
Workarounds
- Wrap retriever calls with a URL validator that resolves hostnames and rejects private, loopback, link-local, and metadata IP ranges.
- Route Web Research Retriever traffic through a filtering forward proxy that blocks internal address destinations.
- Deploy LangChain workloads in network segments with no route to internal services or metadata endpoints.
- Disable the Web Research Retriever entirely if it is not required for the application's functionality.
# Configuration example: restrict outbound egress with iptables to block metadata and RFC1918 destinations
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
