Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use (TOCTOU) attacks on the output_path parameter. Remote attackers can exploit insufficient path validation and symlink following to achieve arbitrary file write and potential code execution on systems where the runtime user has write access to executable or cron locations.
The endpoints responsible for generating screenshots and PDF files do not sufficiently validate the output_path parameter. An attacker can specify a path containing a symbolic link (symlink) as the target, and then exploit a time-of-check-time-of-use (TOCTOU) vulnerability — that is, substitute the symlink target between the moment the path is checked and its actual use. This results in writing attacker-controlled content to any location on the file system accessible to the application process. If the user under whose context the application runs has write permissions to executable locations or cron directories, RCE is possible.
An unauthenticated attacker can write arbitrary files to locations accessible by the application process, which in specific system configurations leads to remote code execution (RCE) through substitution of executable files or cron jobs.
Crawl4AI should be updated to version 0.8.8 or later, which introduces fixes for output_path parameter validation. Details are available in the vendor references: https://github.com/unclecode/crawl4ai/security/advisories/GHSA-7cx2-g3h9-382p
Kidocode Crawl4AI versions before 0.8.8
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XKidocode Crawl4ai
APPKidocode< 0.8.8
Related vulnerabilities
SSRF w Crawl4AI — brak walidacji adresów webhook w Docker API
Crawl4AI: path traversal umożliwiający zapis dowolnych plików i RCE
Crawl4AI: RCE przez wstrzyknięcie argumentów Chromium w Docker API
Crawl4AI: Dowolne wykonanie JavaScript przez endpoint /execute_js
RCE w Crawl4AI — ucieczka z sandbox poprzez atrybuty generatorów Python