Firecrawl has SSRF Vulnerability via malicious scrape target
CVE-2024-56800 has a selected CVSS score of 7.4 (high); EIP currently links 1 repository PoC and 6 lab environments.
Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery (SSRF) vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address. This allowed exfiltration of local network resources through the API. The cloud service was patched on December 27th, 2024, and the maintainers have checked that no user data was exposed by this vulnerability. Scraping engines used in the open sourced version of Firecrawl were patched on December 29th, 2024, except for the playwright services which the maintainers have determined to be un-patchable. All users of open-source software (OSS) Firecrawl should upgrade to v1.1.1. As a workaround, OSS Firecrawl users should supply the playwright services with a secure proxy. A proxy can be specified through the `PROXY_SERVER` env in the environment variables. Please refer to the documentation for instructions. Ensure that the proxy server one is using is setup to block all traffic going to link-local IP addresses.
| Product | Source | Version range | Status |
|---|---|---|---|
firecrawlBrowse mendableai / firecrawl | CVE List | < 1.1.1 | affected |
The artifact is a proof-of-concept exploit for CVE-2024-56800, an SSRF vulnerability in Firecrawl. It includes a Python script (scraper/exploit.py) that uses the Firecrawl SDK to scrape a user-supplied URL, and a README with instructions to set up a malicious server that redirects to an internal service (firecrawl-test-1:80) to demonstrate exfiltration of local network resources.
No backdoor observed in reviewed code
The reviewed text files (README.md and scraper/exploit.py) describe and implement a proof-of-concept for CVE-2024-56800, an SSRF vulnerability in Firecrawl. The README provides instructions for setting up a self-hosted Firecrawl instance and a malicious server to demonstrate the SSRF. The Python script uses the Firecrawl SDK to scrape a user-supplied URL. No backdoor, deceptive payload, or concealed operator-directed harm is observed in the supplied text evidence.
The artifact contains a Python script (scraper/exploit.py) that actively exercises the SSRF vulnerability by using the Firecrawl SDK to scrape a URL, and a README with step-by-step instructions to set up a malicious redirect server to trigger the vulnerability and exfiltrate internal resources. This constitutes exploit code.
scraper/exploit.py:1-19README.md:20-60README.md:27-32README.md:34-39scraper/exploit.py:8scraper/exploit.py:8-18README.md:106-108scraper/exploit.py:9README.md:106This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
A Docker Compose environment for Firecrawl, a web scraping and crawling service, with an additional 'test' service that builds a PHP login page from ./internal_server. The repository name and CVE association suggest this is a proof-of-concept for CVE-2024-56800.
scraper/firecrawl-1.0.0/docker-compose.yaml:1-84scraper/firecrawl-1.0.0/internal_server/Dockerfile:1-8scraper/firecrawl-1.0.0/internal_server/index.php:1-49The repository is named 'cve-2024-56800-poc', and the unit includes a 'test' service that builds a simple PHP login page with hardcoded credentials, which is a common target for demonstrating vulnerabilities. The main Firecrawl services provide a realistic scraping backend, but the presence of the test service and the CVE association indicate a vulnerability research purpose.
scraper/firecrawl-1.0.0/docker-compose.yaml:68-76scraper/firecrawl-1.0.0/internal_server/index.php:5-7Node.js Express server that exposes scraping, crawling, and search endpoints. It uses BullMQ for job queues, connects to Redis, and depends on playwright-service for browser-based scraping. It also includes admin routes and health checks.
scraper/firecrawl-1.0.0/docker-compose.yaml:40-52scraper/firecrawl-1.0.0/apps/api/src/index.ts:1-235A Node.js service that uses Playwright to launch a headless Chromium browser and scrape web pages. It blocks ads and media, supports proxies, and provides a /scrape endpoint.
scraper/firecrawl-1.0.0/docker-compose.yaml:30-39scraper/firecrawl-1.0.0/apps/playwright-service-ts/api.ts:1-227Runs the same image as 'api' but executes the 'workers' command to process scraping jobs from the queue. It shares the network namespace with 'api'.
scraper/firecrawl-1.0.0/docker-compose.yaml:54-60Standard Redis Alpine image used for BullMQ job queues and caching by the API and worker services.
scraper/firecrawl-1.0.0/docker-compose.yaml:62-66Builds a PHP Apache server from ./internal_server that serves a login page with hardcoded credentials (admin/password). It shares the network namespace with 'api' and is likely the target for the CVE proof-of-concept.
scraper/firecrawl-1.0.0/docker-compose.yaml:68-76scraper/firecrawl-1.0.0/internal_server/Dockerfile:1-8scraper/firecrawl-1.0.0/internal_server/index.php:5-7Insufficient evidence
The repository name and unit path include 'CVE-2024-56800', but no CVE description, exploit code, or vulnerability details are present in the supplied evidence. The visible components (Firecrawl services and a PHP login page) do not inherently demonstrate or reference this CVE.
scraper/firecrawl-1.0.0/docker-compose.yaml:1scraper/firecrawl-1.0.0/docker-compose.yaml:1-84scraper/firecrawl-1.0.0/internal_server/Dockerfile:3scraper/firecrawl-1.0.0/docker-compose.yaml:1-84scraper/firecrawl-1.0.0/internal_server/index.php:5-7The environment is a self-contained Docker Compose lab. The 'test' service is a simple PHP login page with hardcoded credentials, which is a typical vulnerable target for exercises. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior is present. The Firecrawl services are standard web scraping components and do not exhibit malicious actions.
scraper/firecrawl-1.0.0/docker-compose.yaml:1-84scraper/firecrawl-1.0.0/internal_server/index.php:1-49This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
Packet coverage: some source evidence omitted
A Dockerized Playwright service built on Python 3.11-slim that provides a FastAPI endpoint to fetch and return HTML content of a given URL using a headless Chromium browser. It includes optional proxy support and media blocking.
scraper/firecrawl-1.0.0/apps/playwright-service/Dockerfile:1-38scraper/firecrawl-1.0.0/apps/playwright-service/main.py:1-109The repository name includes 'cve-2024-56800-poc', suggesting a vulnerability proof-of-concept. However, the supplied evidence (Dockerfile, application code, dependencies) does not contain any explicit vulnerability reproduction steps, exploit code, or references to CVE-2024-56800. The service appears to be a standard web scraping microservice. Without additional context, the purpose cannot be definitively classified as a vulnerability lab.
scraper/firecrawl-1.0.0/apps/playwright-service/Dockerfile:1-38scraper/firecrawl-1.0.0/apps/playwright-service/main.py:1-109A FastAPI service that uses Playwright to launch a headless Chromium browser. It exposes endpoints for health checks and an /html POST endpoint that accepts a URL, fetches the page, and returns its HTML content. It supports optional proxy configuration and media blocking via environment variables.
scraper/firecrawl-1.0.0/apps/playwright-service/main.py:1-109scraper/firecrawl-1.0.0/apps/playwright-service/Dockerfile:1-38A Python module that maps HTTP status codes to human-readable error messages. Used by the main service to provide error descriptions in responses.
scraper/firecrawl-1.0.0/apps/playwright-service/get_error.py:1-63Insufficient evidence
The supplied evidence does not mention CVE-2024-56800, nor does it contain any exploit code, vulnerable dependency, or configuration that can be linked to this CVE. The repository name suggests a PoC, but no supporting evidence is present in the analyzed files.
scraper/firecrawl-1.0.0/apps/playwright-service/Dockerfile:12-13scraper/firecrawl-1.0.0/apps/playwright-service/Dockerfile:28scraper/firecrawl-1.0.0/apps/playwright-service/Dockerfile:33scraper/firecrawl-1.0.0/apps/playwright-service/main.py:13-15The Dockerfile and application code describe a standard web scraping service. There is no evidence of host escape, external connections beyond the intended scraping, persistence mechanisms, credential theft, or destructive behavior. The service listens on a configurable port and fetches URLs as requested, which is its documented purpose.
scraper/firecrawl-1.0.0/apps/playwright-service/Dockerfile:1-38scraper/firecrawl-1.0.0/apps/playwright-service/main.py:1-109This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A single Dockerfile builds a PHP 8.2 Apache container, copying a nearly empty index.php into the web root and exposing port 80. The README describes a proof-of-concept for CVE-2024-56800, a Firecrawl SSRF vulnerability, but the Dockerfile and index.php do not implement any Firecrawl or SSRF components.
rce/Dockerfile:1-5rce/index.php:1-3README.md:1-131The README describes a vulnerability lab for CVE-2024-56800, but the provided Dockerfile and index.php do not contain any vulnerable target, exploit, or lab infrastructure. The directory name 'rce' and the empty PHP file do not match the SSRF proof-of-concept described in the README. The evidence is insufficient to confirm this unit is a vulnerability lab.
rce/Dockerfile:1-5rce/index.php:1-3README.md:1-131A container based on php:8.2-apache that serves content from /var/www/html on port 80. The only copied file is an empty index.php.
rce/Dockerfile:1-5rce/index.php:1-3Insufficient evidence
The README describes CVE-2024-56800 as an SSRF in Firecrawl, but the provided Dockerfile and index.php do not contain Firecrawl, any SSRF target, or any exploit code. No evidence in the unit supports or contradicts the CVE association.
rce/Dockerfile:1-5rce/index.php:1-3README.md:1-131The unit contains only a basic PHP Apache container with no visible behavior beyond serving an empty page. No exploit, network access, or harmful actions are defined. The README describes a separate multi-container lab not present in this unit.
rce/Dockerfile:1-5rce/index.php:1-3This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A single Dockerfile builds a PHP Apache server that issues a 301 redirect to 127.0.0.1:80. The README describes it as a 'malicious server' used in a proof-of-concept for CVE-2024-56800, a server-side request forgery (SSRF) vulnerability in Firecrawl.
malicious_server/Dockerfile:1-5malicious_server/index.php:1-6README.md:1-131The README explicitly states this is a POC for CVE-2024-56800, describes the vulnerability, and provides step-by-step instructions to reproduce the SSRF using this 'malicious_server' component. The Dockerfile and PHP code serve only to redirect requests, which is the mechanism to trigger the SSRF against a self-hosted Firecrawl instance.
README.md:1-2README.md:7-12README.md:27-37A PHP application running on Apache that responds to any request with a 301 redirect to http://127.0.0.1:80. This is used to cause the Firecrawl scraper to follow the redirect and access internal resources.
malicious_server/Dockerfile:1-5malicious_server/index.php:1-6README.md:27-37Supported by supplied evidence
The README describes CVE-2024-56800 as an SSRF in Firecrawl, and the provided malicious server redirects to 127.0.0.1:80, which is the exact behavior needed to demonstrate the vulnerability by causing the scraper to access internal resources. The POC steps align with the described vulnerability.
README.md:7-12malicious_server/index.php:1-6README.md:27-37README.md:27-32README.md:39-47README.md:34-35README.md:36README.md:39-47README.md:49-57The Dockerfile and PHP code only set up a simple redirect server. There is no evidence of hidden behavior, host escape, persistence, credential theft, data destruction, or any action beyond serving a 301 redirect. The redirect target (127.0.0.1:80) is the loopback address, which in the context of the Firecrawl server would access its own internal services, not the Docker host or external systems. The exercise is contained within the described lab scenario.
malicious_server/Dockerfile:1-5malicious_server/index.php:1-6This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A Docker container based on Ubuntu 18.04 that installs Python 3 and pip, copies a local directory containing a Python exploit script and a copy of the Firecrawl web scraping tool, sets environment variables pointing to a Docker API URL, and runs a Python server script with a hardcoded ngrok URL as an argument.
scraper/Dockerfile:1-19The repository name 'cve-2024-56800-poc' and the presence of an exploit script ('exploit.py') that uses the Firecrawl library to scrape a URL indicate a proof-of-concept for CVE-2024-56800. The Dockerfile builds an environment to run this exploit against a self-hosted Firecrawl instance.
scraper/exploit.py:1-19scraper/Dockerfile:1-19A Python script that imports the Firecrawl SDK, connects to a local Firecrawl API at http://localhost:3002 using a fake API key, and calls scrape_url on a URL provided as a command-line argument.
scraper/exploit.py:1-19A Python script referenced in the Dockerfile CMD but not included in the supplied evidence. Its behavior is unknown.
scraper/Dockerfile:18A copy of the Firecrawl web scraping tool (version 1.0.0) included in the build context. It contains a self-hosted API server, workers, a Playwright service, and an internal test server. The exploit script imports its Python SDK.
scraper/firecrawl-1.0.0/README.md:1-506scraper/firecrawl-1.0.0/docker-compose.yaml:1-84A simple PHP login page with hardcoded credentials (admin/password) built from a Dockerfile. It is defined as a service in the Firecrawl docker-compose.yaml but its ports are commented out.
scraper/firecrawl-1.0.0/internal_server/index.php:1-49scraper/firecrawl-1.0.0/docker-compose.yaml:70-78Insufficient evidence
The repository name and exploit script suggest a proof-of-concept for CVE-2024-56800, but the supplied evidence does not describe the vulnerability, its impact, or how the exploit triggers it. The exploit script only performs a benign scrape_url call. No CVE details are present in the packet.
scraper/exploit.py:1-19scraper/exploit.py:7scraper/Dockerfile:14scraper/exploit.py:10-12scraper/Dockerfile:18scraper/exploit.py:3-4scraper/Dockerfile:1-19scraper/firecrawl-1.0.0/docker-compose.yaml:1-84scraper/exploit.py:7scraper/Dockerfile:18scraper/exploit.py:13-17The critical executable script 'server.py' is not included in the evidence, so its behavior cannot be assessed. The visible exploit script only makes a local API call to a Firecrawl instance. No concrete harmful behavior (host compromise, data destruction, unauthorized external communication) is observed in the supplied files.
scraper/Dockerfile:18This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
Packet coverage: some source evidence omitted · 1 binary file not inspected
A Docker environment based on bitnami/redis:7.2.5 that copies a custom start script into the image and runs it as the default command. The script configures kernel parameters, sets a password, and starts redis-server with memory and persistence options.
scraper/firecrawl-1.0.0/apps/redis/Dockerfile:1-6scraper/firecrawl-1.0.0/apps/redis/start-redis-server.sh:1-30The repository name 'cve-2024-56800-poc' suggests a vulnerability proof-of-concept, but the visible evidence in this unit only shows a standard Redis container setup with no exploit code, vulnerable target, or reproduction steps. The README describes a general Redis deployment on Fly.io, not a vulnerability lab.
scraper/firecrawl-1.0.0/apps/redis/README.md:1-48A Redis server based on bitnami/redis:7.2.5, started by a custom script that sets kernel parameters, configures a password, and applies memory and persistence settings.
scraper/firecrawl-1.0.0/apps/redis/Dockerfile:1-6scraper/firecrawl-1.0.0/apps/redis/start-redis-server.sh:1-30Insufficient evidence
No evidence in the supplied files references CVE-2024-56800, describes a vulnerability, or provides a proof-of-concept. The unit contains only a standard Redis Dockerfile and startup script.
scraper/firecrawl-1.0.0/apps/redis/start-redis-server.sh:8-10The visible behavior is limited to starting a Redis server with standard configuration. No host escape, external connections, persistence, credential theft, or destructive actions are present.
scraper/firecrawl-1.0.0/apps/redis/start-redis-server.sh:1-30This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.