CVE-2024-3095: SSRF in langchain-community Web Research Retriever

# CVE-2024-3095: SSRF in langchain-community Web Research Retriever

https://gcdradar.vercel.app/incidents/cve-2024-3095-ssrf-in-langchain-community-web-research-retri · AIR-2024-0133 · closed 2024-06-06

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-06-06
- AI role: Attack on AI
- Products: langchain-community
- CVE ids: CVE-2024-3095
- CVSS: 4.8

## Summary

A Server-Side Request Forgery vulnerability in the LangChain community Web Research Retriever permits remote requests to local addresses. Attackers can exploit this flaw to conduct port scans and access cloud instance metadata.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-06-06: CVE-2024-3095: A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain… (https://nvd.nist.gov/vuln/detail/CVE-2024-3095)
- 2024-06-06: CVE-2024-3095: Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever (https://github.com/advisories/GHSA-q25c-c977-4cmh)

## Sources

- 2024-06-06 GitHub Advisory Database: CVE-2024-3095: Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever https://github.com/advisories/GHSA-q25c-c977-4cmh
- 2024-06-06 NVD: CVE-2024-3095: A Server-Side Request Forgery (SSRF) vulnerability exists in the Web Research Retriever component of langchain-ai/langchain… https://nvd.nist.gov/vuln/detail/CVE-2024-3095

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.