A critical server-side request forgery vulnerability in Firecrawl allows unauthenticated attackers to bypass network security controls and access internal services via malicious redirects.

The vulnerability exists in the Playwright scraping service, where network policy validation is performed only on the initial URL. An unauthenticated attacker can supply a URL that redirects to internal or restricted network resources, causing the service to bypass security filters and fetch sensitive data from the internal network.

This vulnerability poses a significant risk to internal infrastructure by allowing unauthorized access to restricted endpoints that are typically shielded from the public internet. A successful exploit could lead to the exposure of sensitive internal data, configuration information, or administrative interfaces, potentially facilitating further lateral movement within the network. Given the CVSS score of 8.6, this flaw represents a high-severity risk that requires immediate attention to prevent unauthorized internal reconnaissance.

Immediate Action: Upgrade Firecrawl to a version beyond 2.8.0 where the post-redirect enforcement gap has been addressed.

Proactive Monitoring: Review application access logs for unusual outbound request patterns or unexpected traffic directed toward internal IP ranges or sensitive internal services.

Compensating Controls: Implement strict network egress filtering at the firewall level to prevent the scraping service from initiating connections to internal network segments or unauthorized private IP addresses.

Public Exploit Available: Unknown

The risk associated with this SSRF vulnerability is substantial, particularly for deployments where Firecrawl has access to sensitive internal network segments. Organizations should prioritize updating to the latest secure version of the software as the primary method of mitigation. If an immediate patch is not feasible, egress filtering must be enforced to restrict the scraping service from reaching internal resources.