CVE-2024-8955 Overview
CVE-2024-8955 is a Server-Side Request Forgery (SSRF) vulnerability in composiohq/composio version 0.4.4. The flaw resides in the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions. Attackers can abuse these browser tool actions to make the server fetch arbitrary URIs, including local file:// resources. This allows a remote, unauthenticated attacker to read the contents of any file accessible to the Composio process. The weakness is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Remote, unauthenticated attackers can read arbitrary files on the host running Composio, exposing secrets, credentials, and configuration data used by AI agent workflows.
Affected Products
- Composio (composiohq/composio) version 0.4.4
- Deployments using BROWSERTOOL_GOTO_PAGE action
- Deployments using BROWSERTOOL_GET_PAGE_DETAILS action
Discovery Timeline
- 2025-03-20 - CVE-2024-8955 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8955
Vulnerability Analysis
Composio is an integration platform used by AI agents to connect with external tools and services. The BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions accept a URL parameter and instruct the browser tool to navigate to and return content from that URL. The affected version does not validate or restrict the URL scheme or destination host before dispatching the request. An attacker can supply a file:// URI or an internal network address, causing the server-side browser to load the target and return its contents in the tool response.
Because AI agents frequently execute browser tool calls on behalf of user prompts, the SSRF can be triggered indirectly through prompt injection against an agent that exposes these Composio actions. Successful exploitation returns full file contents to the caller, breaking the confidentiality boundary of the host.
Root Cause
The root cause is missing URL scheme allowlisting and destination validation in the browser tool action handlers. The tool trusts caller-supplied URLs and passes them directly to the underlying fetch or headless browser navigation logic. Without a scheme filter that rejects file://, gopher://, and internal metadata endpoints, the tool becomes a general-purpose file and network read primitive.
Attack Vector
Exploitation requires network access to the Composio server or the ability to influence an AI agent that invokes Composio browser actions. The attacker crafts a request that calls BROWSERTOOL_GOTO_PAGE or BROWSERTOOL_GET_PAGE_DETAILS with a URL such as file:///etc/passwd, file:///root/.ssh/id_rsa, or an internal URL like http://169.254.169.254/latest/meta-data/. The server returns the fetched contents to the caller. No authentication or user interaction is required for network-adjacent attackers. Refer to the Huntr Bounty Report for the disclosure details.
Detection Methods for CVE-2024-8955
Indicators of Compromise
- Composio action logs containing BROWSERTOOL_GOTO_PAGE or BROWSERTOOL_GET_PAGE_DETAILS invocations with file:// URIs
- Browser tool requests targeting loopback addresses (127.0.0.1, localhost) or link-local metadata endpoints (169.254.169.254)
- Outbound HTTP responses containing contents of /etc/passwd, /etc/shadow, or SSH private keys returned to agent callers
Detection Strategies
- Inspect Composio server logs for browser tool actions whose URL argument uses non-http/https schemes
- Alert on browser tool navigation to RFC1918 addresses, loopback ranges, or cloud metadata IPs
- Correlate AI agent prompt content with subsequent browser tool calls to detect prompt-injection-driven SSRF
Monitoring Recommendations
- Enable verbose logging on all Composio tool invocations and forward events to a centralized data lake
- Baseline normal browser tool destinations and alert on deviations, especially internal-only hosts
- Monitor egress traffic from Composio hosts for unexpected internal reads or cloud metadata access
How to Mitigate CVE-2024-8955
Immediate Actions Required
- Upgrade composiohq/composio beyond version 0.4.4 to a release containing the SSRF fix
- Disable BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions if they are not required for agent workflows
- Run Composio in a hardened network segment with egress restricted to required external destinations
- Remove sensitive credentials, keys, and configuration files from the Composio process filesystem
Patch Information
No vendor advisory URL is listed in the NVD entry. Consult the Huntr Bounty Report and the upstream composiohq/composio repository for the fixed release and patch commit. Upgrade to the latest available version.
Workarounds
- Enforce a URL scheme allowlist that permits only http and https at a reverse proxy in front of Composio
- Block outbound traffic from the Composio host to loopback, RFC1918, and cloud metadata addresses using host or network firewalls
- Run Composio as an unprivileged user in a container with a minimal filesystem to limit the value of arbitrary file reads
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
