CVE-2024-8952: Composio SSRF Vulnerability

CVE-2024-8952 Overview

CVE-2024-8952 is a Server-Side Request Forgery (SSRF) vulnerability affecting composiohq/composio version 0.4.2. The flaw resides in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint, which fetches remote content without validating the destination URL. Attackers can coerce the server into issuing arbitrary HTTP requests on their behalf.

The vulnerability is categorized under [CWE-918] Server-Side Request Forgery. Exploitation enables reading local files, retrieving AWS instance metadata, and interacting with internal services reachable from the host. Because the endpoint accepts unauthenticated network input, the attack surface extends to any client capable of reaching the API.

Critical Impact
Unauthenticated attackers can pivot into internal networks, exfiltrate cloud instance credentials from the AWS metadata service, and read sensitive files accessible to the Composio process.

Affected Products

composiohq/composio version 0.4.2
Deployments exposing the WEBTOOL_SCRAPE_WEBSITE_CONTENT action
Cloud-hosted Composio instances running on AWS EC2 with IMDSv1 enabled

Discovery Timeline

2025-03-20 - CVE-2024-8952 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8952

Vulnerability Analysis

Composio exposes a web-scraping action at /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT. The endpoint accepts a user-supplied URL and issues an outbound HTTP request from the server. The implementation performs no allowlist enforcement, no scheme filtering, and no validation against internal IP ranges.

An attacker submits URLs pointing at internal resources instead of legitimate external websites. The server dutifully fetches the target and returns response content to the caller. This turns the Composio host into a proxy for reaching resources otherwise segmented from the public network.

Sensitive targets include the AWS Instance Metadata Service at http://169.254.169.254/latest/meta-data/, internal admin dashboards on RFC1918 addresses, and local services bound to 127.0.0.1. Where the process supports file:// schemes, attackers can also read local files.

Root Cause

The root cause is missing URL validation before the server-side fetch. The scraping action trusts caller-controlled input and forwards it directly to the HTTP client without checking scheme, host resolution, or destination IP range.

Attack Vector

Exploitation requires only network access to the Composio API. No authentication or user interaction is needed. An attacker sends a POST request to the vulnerable endpoint with a crafted URL parameter, then reads the reflected response body containing internal data.

See the Huntr Bounty Report for the disclosed proof of concept and reproduction steps.

Detection Methods for CVE-2024-8952

Indicators of Compromise

Outbound HTTP requests from the Composio host to 169.254.169.254, 127.0.0.1, or RFC1918 addresses originating from the scraping action.
Application logs showing WEBTOOL_SCRAPE_WEBSITE_CONTENT invocations with non-public URLs in the target parameter.
Unexpected access patterns to AWS IAM role credentials issued to the EC2 instance hosting Composio.

Detection Strategies

Inspect reverse proxy and application logs for POST requests to /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT and parse the destination URL argument.
Alert on outbound connections from the Composio process to link-local, loopback, or private address ranges.
Correlate cloud audit logs (AWS CloudTrail) with Composio activity to spot metadata-service abuse or credential reuse from unexpected source IPs.

Monitoring Recommendations

Enable IMDSv2 on EC2 hosts and monitor for IMDSv1 fallback attempts.
Instrument the Composio HTTP client to emit structured logs containing target hostname, resolved IP, and response size.
Track anomalous egress volume from the Composio host, which may indicate bulk metadata or file exfiltration.

How to Mitigate CVE-2024-8952

Immediate Actions Required

Upgrade composiohq/composio to a release later than 0.4.2 that addresses the SSRF flaw.
Restrict outbound network access from the Composio host to only the domains required for legitimate scraping.
Enforce IMDSv2 on all EC2 instances running Composio to block unauthenticated metadata retrieval.

Patch Information

Refer to the Huntr Bounty Report for remediation guidance from the maintainer. Upgrade to the latest available Composio release and review release notes for SSRF-related fixes to the WEBTOOL_SCRAPE_WEBSITE_CONTENT action.

Workarounds

Disable the WEBTOOL_SCRAPE_WEBSITE_CONTENT action if it is not required for your workflow.
Place the Composio service behind an egress proxy that blocks requests to 169.254.169.254, 127.0.0.0/8, and RFC1918 ranges.
Enforce network policies that deny the Composio pod or container access to the cloud metadata service and internal management interfaces.

bash

# Example AWS CLI command to enforce IMDSv2 on the host running Composio
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-endpoint enabled