CVE-2025-57818: Firecrawl Webhook SSRF Vulnerability

CVE-2025-57818 Overview

CVE-2025-57818 is a Server-Side Request Forgery (SSRF) vulnerability in Firecrawl, an open-source tool that converts websites into LLM-ready markdown or structured data. Versions prior to 2.0.1 allow authenticated users to configure a webhook pointing to an internal URL and send POST requests with arbitrary headers. This behavior can be abused to reach internal systems that should not be exposed to the webhook client. The maintainers fixed the issue in version 2.0.1 by routing webhook requests through a secureDispatcher. The weakness is classified as CWE-918.

Critical Impact
Authenticated users can pivot Firecrawl's webhook feature to send crafted HTTP requests to internal network resources, enabling reconnaissance and interaction with services that trust the Firecrawl host.

Affected Products

Firecrawl versions prior to 2.0.1
Firecrawl webhook service (apps/api/src/services/webhook.ts)
Self-hosted Firecrawl deployments exposing webhook configuration to authenticated users

Discovery Timeline

2025-08-26 - CVE-2025-57818 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57818

Vulnerability Analysis

Firecrawl's webhook subsystem accepts a user-supplied destination URL and dispatches HTTP POST requests to that endpoint when scrape or crawl events fire. Before version 2.0.1, the dispatcher relied on axios without validating whether the target URL resolved to an internal address. An authenticated user could therefore target loopback interfaces, link-local metadata endpoints, or private network hosts reachable from the Firecrawl server. Because the caller controls the request headers, the flaw can be used to probe internal services, forward tokens, or interact with APIs that authenticate based on network origin.

Root Cause

The root cause is missing egress validation on webhook destinations [CWE-918]. The webhook service used a general-purpose HTTP client with no address filtering. Requests to private IP ranges, 127.0.0.0/8, or cloud metadata endpoints such as 169.254.169.254 were treated the same as public destinations.

Attack Vector

An attacker with valid Firecrawl credentials configures a webhook whose URL points to an internal resource. When Firecrawl triggers the webhook, the server issues a POST request from its own network position, returning response side effects observable to the attacker or acting on internal APIs. No user interaction is required beyond normal API authentication.

typescript

// Fix in apps/api/src/services/webhook.ts
-import axios, { AxiosError } from "axios";
+import undici from "undici";
+import { secureDispatcher } from "../scraper/scrapeURL/engines/utils/safeFetch";
 import { logger as _logger, logger } from "../lib/logger";
 import { supabase_rr_service, supabase_service } from "./supabase";
 import { WebhookEventType } from "../types";
 import { configDotenv } from "dotenv";
 import { z } from "zod";
 import { webhookSchema } from "../controllers/v1/types";
 import { redisEvictConnection } from "./redis";
-import { index_supabase_service } from ".";
 configDotenv();

 const WEBHOOK_INSERT_QUEUE_KEY = "webhook-insert-queue";

The patch replaces axios with undici and routes requests through secureDispatcher, which enforces address filtering to block private and reserved ranges. Source: GitHub Commit b15fae5.

Detection Methods for CVE-2025-57818

Indicators of Compromise

Webhook configurations with destination URLs resolving to RFC1918 ranges, 127.0.0.0/8, 169.254.0.0/16, or IPv6 loopback and link-local addresses.
Outbound HTTP requests from the Firecrawl host to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Unexpected authenticated webhook creation events targeting hostnames that resolve to internal DNS zones.

Detection Strategies

Audit stored webhook records in the Firecrawl database and flag entries whose URLs resolve to non-public addresses.
Inspect reverse proxy or egress firewall logs for POST requests originating from the Firecrawl service to internal hosts.
Correlate Firecrawl API authentication events with subsequent webhook configuration changes to identify abuse by compromised accounts.

Monitoring Recommendations

Log all webhook create and update calls, including the destination URL, requesting principal, and source IP.
Alert on egress traffic from Firecrawl containers or hosts to private CIDR ranges and cloud metadata IPs.
Enable DNS query logging on the Firecrawl host to detect resolution of internal-only hostnames.

How to Mitigate CVE-2025-57818

Immediate Actions Required

Upgrade Firecrawl to version 2.0.1 or later, which enforces the secureDispatcher for webhook requests.
Review existing webhook configurations and remove any pointing to internal, loopback, or metadata addresses.
Rotate any credentials or tokens that may have been exposed through internal endpoints reachable from the Firecrawl host.

Patch Information

The fix is shipped in Firecrawl v2.0.1. Technical details are documented in the GitHub Security Advisory GHSA-p2wg-prhf-jx79 and the corresponding commits b15fae5 and e8cf098.

Workarounds

Isolate Firecrawl from sensitive internal systems using network segmentation and egress firewall rules.
Block outbound traffic from the Firecrawl host to RFC1918 ranges, 127.0.0.0/8, and cloud metadata endpoints.
Restrict webhook creation to trusted operators and require review of destination URLs before enabling webhooks.

bash

# Example egress restriction using iptables on the Firecrawl host
iptables -A OUTPUT -m owner --uid-owner firecrawl -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner firecrawl -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner firecrawl -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner firecrawl -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner firecrawl -d 169.254.0.0/16 -j REJECT