CVE-2024-56800: Firecrawl Web Scraper SSRF Vulnerability

CVE-2024-56800 Overview

CVE-2024-56800 is a server-side request forgery (SSRF) vulnerability in Firecrawl, a web scraper that extracts webpage content for large language models. Versions prior to 1.1.1 allow attackers to exploit the scraping engine by crafting a malicious site that redirects to a local IP address. This behavior enables exfiltration of local network resources through the Firecrawl API. The maintainers patched the cloud service on December 27, 2024, and open-source scraping engines on December 29, 2024. The Playwright services remain un-patchable and require a secure proxy workaround. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can coerce the Firecrawl scraping engine into requesting internal network resources, exposing cloud metadata services and link-local endpoints.

Affected Products

Firecrawl open-source versions prior to 1.1.1
Firecrawl cloud service prior to December 27, 2024
Firecrawl Playwright scraping services (un-patchable; requires proxy workaround)

Discovery Timeline

December 27, 2024 - Firecrawl cloud service patched by maintainers
December 29, 2024 - Open-source scraping engines patched (excluding Playwright services)
2024-12-30 - CVE-2024-56800 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-56800

Vulnerability Analysis

Firecrawl accepts a user-supplied URL and fetches its content on behalf of the caller. The scraping engine followed HTTP redirects without validating the resolved destination. An attacker hosts a public URL that responds with an HTTP redirect to a private or link-local address such as 127.0.0.1, 169.254.169.254, or 10.0.0.0/8. The scraper then issues a request from within the Firecrawl infrastructure and returns the response body to the attacker.

This pattern allows retrieval of cloud instance metadata, internal service endpoints, and other resources reachable from the scraping worker. The exposure spans confidentiality, integrity, and availability because internal APIs may permit state-changing operations without authentication. The vulnerability affects the fetch engine and, until the workaround is applied, the Playwright-based engines.

Root Cause

The root cause is missing destination validation in the outbound HTTP client. The scraping engines relied on the default fetch behavior, which follows redirects to any resolved IP address. There was no dispatcher enforcing an IP allowlist or blocking loopback, private, and link-local ranges before establishing the TCP connection.

Attack Vector

The attack requires network access to the Firecrawl API and low-privileged authentication. An attacker submits a scrape request pointing at an attacker-controlled host. That host issues a 302 redirect to a target such as http://169.254.169.254/latest/meta-data/. The scraper follows the redirect and returns the internal response to the attacker.

typescript

// Security patch: apps/api/src/scraper/scrapeURL/engines/fetch/index.ts
+import * as undici from "undici";
 import { EngineScrapeResult } from "..";
 import { Meta } from "../..";
 import { TimeoutError } from "../../error";
 import { specialtyScrapeCheck } from "../utils/specialtyHandler";
+import { InsecureConnectionError, makeSecureDispatcher } from "../utils/safeFetch";
 
 export async function scrapeURLWithFetch(
   meta: Meta,
   timeToRun: number | undefined,
 ): Promise<EngineScrapeResult> {
   const timeout = timeToRun ?? 300000;
 
-  const response = await Promise.race([
-    fetch(meta.url, {
-      redirect: "follow",
-      headers: meta.options.headers,
-    }),
-    (async () => {
-      await new Promise((resolve) => setTimeout(() => resolve(null), timeout));
-      throw new TimeoutError(
-        "Fetch was unable to scrape the page before timing out",
-        { cause: { timeout } },
-      );
-    })(),
-  ]);
+  let response: undici.Response;
+  try {
+    response = await Promise.race([
+      undici.fetch(meta.url, {

Source: GitHub commit 4d1f92f. The patch replaces the native fetch with undici.fetch using a makeSecureDispatcher that blocks loopback and link-local IP addresses at the connection layer.

Detection Methods for CVE-2024-56800

Indicators of Compromise

Outbound HTTP requests from Firecrawl workers to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local 169.254.0.0/16.
Scrape requests targeting attacker-controlled domains that respond with 3xx redirects to private addresses.
API access logs showing repeated scrape submissions from the same authenticated principal against unusual external hosts.

Detection Strategies

Parse Firecrawl API logs for url parameters resolving to internal addresses after DNS or redirect resolution.
Correlate egress network flow logs from the scraper subnet with cloud metadata endpoint access (169.254.169.254).
Alert on any process spawned by the Firecrawl worker issuing requests to loopback interfaces.

Monitoring Recommendations

Enable verbose request logging in the Firecrawl API and forward events to a centralized SIEM for retention.
Instrument the outbound proxy with allow/deny lists and log every blocked destination.
Track Firecrawl version strings across deployments and alert when instances remain below 1.1.1.

How to Mitigate CVE-2024-56800

Immediate Actions Required

Upgrade all open-source Firecrawl deployments to version 1.1.1 or later.
Route Playwright scraping services through a secure proxy configured via the PROXY_SERVER environment variable.
Configure the proxy to block traffic to loopback, private, and link-local IP ranges, including 169.254.169.254.
Rotate any secrets, cloud instance credentials, or metadata tokens that may have been reachable from the scraper.

Patch Information

The fix is delivered in Firecrawl 1.1.1 via commit 4d1f92f4c8c36403022428285a03621fd90d62ec. The patch introduces makeSecureDispatcher in safeFetch.ts and applies it to the fetch engine and downloadFile helper. Full details are available in the GitHub Security Advisory GHSA-vjp8-2wgg-p734.

Workarounds

Set PROXY_SERVER in the Firecrawl environment to a hardened forward proxy for Playwright engines.
Deploy the proxy with explicit deny rules for 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.
Place Firecrawl workers in a network segment that has no route to cloud metadata services or internal management APIs.

bash

# Configuration example: block link-local and private ranges via env-configured proxy
export PROXY_SERVER="http://secure-proxy.internal:3128"

# Example squid ACL enforcing the block list
# acl link_local dst 169.254.0.0/16
# acl loopback dst 127.0.0.0/8
# acl rfc1918_a dst 10.0.0.0/8
# acl rfc1918_b dst 172.16.0.0/12
# acl rfc1918_c dst 192.168.0.0/16
# http_access deny link_local
# http_access deny loopback
# http_access deny rfc1918_a rfc1918_b rfc1918_c