CVE-2023-46229 LangChain Server Side Request Forgery vulnerability

What is CVE-2023-46229?

CVE-2023-46229 is a high-severity server-side request forgery vulnerability in n/a, published on 19 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

Weakness: CWE-918

Which versions are affected by CVE-2023-46229?

3 open source packages ship an affected version, including langchain. It affects 1 product.

Products include Langchain Langchain.

How do I fix CVE-2023-46229?

Upgrade langchain to 0.0.317 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-46229 being exploited?

There is no known exploitation of CVE-2023-46229 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-39631 Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library Critical 9.8
• CVE-2023-36281 langchain vulnerable to arbitrary code execution Critical 9.8
• CVE-2023-38860 LangChain vulnerable to arbitrary code execution Critical 9.8
• CVE-2023-38896 LangChain vulnerable to arbitrary code execution Critical 9.8
• CVE-2023-39659 LangChain vulnerable to arbitrary code execution Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-655w-fm8m-m478, PYSEC-2023-205.