CVE-2024-8955
Published: 20 March 2025
Summary
CVE-2024-8955 is a high-severity SSRF (CWE-918) vulnerability in Composio Composio. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 34.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-8955 is a Server-Side Request Forgery (SSRF) vulnerability in composiohq/composio version v0.4.4. The issue resides in the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions, which can be exploited to read the contents of any file on the affected system. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-918.
An unauthenticated attacker with network access can exploit this vulnerability with low complexity and no user interaction required. By sending crafted requests to the vulnerable actions, the attacker achieves arbitrary file read access on the server, resulting in high confidentiality impact but no integrity or availability disruption.
Mitigation details are available in the advisory published on Huntr at https://huntr.com/bounties/13bc0399-2d9b-449e-95f2-6e9a7e39383d.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6889
Vulnerability details
A Server-Side Request Forgery (SSRF) vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF vulnerability enables arbitrary local file reads, facilitating T1005 (Data from Local System) for collecting data from files and T1552.001 (Credentials in Files) for accessing unsecured credentials.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires identification, reporting, and correction of the specific SSRF flaw in composio v0.4.4, directly eliminating the vulnerability allowing arbitrary file reads.
SI-10 mandates validation of inputs to the BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions, preventing crafted SSRF payloads that enable file reads.
AC-4 enforces controls on information flows from the application to internal resources, blocking unauthorized SSRF requests to local file system endpoints.