CVE-2024-8952: composio Server-Side Request Forgery (SSRF) vulnerability

March 20, 2025 (updated March 21, 2025)

A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOL_SCRAPE_WEBSITE_CONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system.

References

github.com/ComposioHQ/composio
github.com/advisories/GHSA-qvg9-vp87-h3hr
huntr.com/bounties/d1acdd38-10d7-45df-9df0-9fc71f0e1c2a
nvd.nist.gov/vuln/detail/CVE-2024-8952

Code Behaviors & Features

Detect and mitigate CVE-2024-8952 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →