CVE-2023-46229: Server-Side Request Forgery (SSRF) Vulnerability in LangChain
As large language model (LLM) applications continue to evolve, popular tools like LangChain have become very essential for building sophisticated AI pipelines that interact with real-world data sources. These frameworks often include data loaders that help retrieve documents from the web, database, APIs, etc. so that the developers can feed them into language models.
But this simple web scraper can easily become an entry point for attackers. In October 2023, one such critical vulnerability is discovered in LangChain’s “SitemapLoader” module (a utility designed to fetch and parse sitemap URLs) which is tracked as CVE-2023-46229.
In this blog we will take a closer look at the traffic pattern of this attack, including how one can reproduce the vulnerable setup and its exploitation.
Vulnerable Setup and Exploitation
Server-Side Request Forgery (SSRF) is a type of web attack (CWE-918) where the attacker tricks the server to make a request to an unintended internal or external system. This can lead to exposure of sensitive data, access to cloud metadata, or interaction with internal APIs.
As per the information from MITRE and NIST, LangChain versions 0.0.316 and earlier are vulnerable to CVE-2023-46229. The vulnerability arises from the SitemapLoader component, which did not validate or restrict URLs found in a sitemap, allowing potential exploitation via Server-Side Request Forgery (SSRF). So, to understand the vulnerability better, ATI security researchers have created a vulnerable setup locally using the LangChain v0.0.316.
The researchers first crafted a malicious sitemap.xml containing the URL “http://127.0.0.1/secret”. They then hosted a local HTTP server to simulate an internal service responding at that endpoint as shown below –
Figure 1: Malicious Sitemap XML containing local URLs and files
Now, when the attacker uses LangChain's SitemapLoader to load the malicious_sitemap.xml, the loader blindly follows each URL listed including internal addresses like “http://127.0.0.1/secret”.
Figure 2: Vulnerable LangChain’s SitemapLoader accessing its local files
This triggers a classic Server-Side Request Forgery (SSRF), where the server makes an unintended internal request on behalf of the attacker. If the targeted internal service responds with sensitive data such as tokens, configuration files, or system metadata that information is fetched and returned to the attacker-controlled context, leading to potential data leakage or unauthorized access.
Patch Diff Analysis
To address this vulnerability, the LangChain team has introduced a patch in the version 0.0.317. This patch focused on restricting which URLs are allowed to be fetched from a sitemap by adding a filtering mechanism to the SitemapLoader.
- A domain extraction method is added to safely the extracts the scheme and domain from any given URL.
Figure 3: Domain extraction method is added in patch
This will prevent the SSRF as it allows the code to compare each URL’s origin and restrict out of domain access.
- A default safeguard is added to block URLs that don’t originate from the same domain as the main sitemap.
Figure 4: Default safeguard is added in patch
Prevents automatically fetching internal/cloud infrastructure URLs unless the user explicitly disables this safeguard.
- Next a dual-layer check is added to validate each URL in the sitemap. First, it ensures that the URL shares the same scheme and domain as the original sitemap (web_path) if restrict_to_same_domain is enabled. Then, it applies regex-based filtering using filter_urls to allow only URLs that match defined patterns.
Figure 5: Dual layer URL validation logic is added in patch
Together, these checks prevent SSRF by blocking access to internal or off-domain resources and ensuring only explicitly allowed URLs are processed.
Attack Traffic Analysis
From the captured traffic, we observe two GET requests. First, the attacker sends a request to the vulnerable server, instructing it to fetch a malicious_sitemap.xml file hosted on the attacker’s server. Once retrieved, LangChain’s SitemapLoader parses the XML and identifies embedded URLs.
Figure 6: First HTTP GET request to access sitemap XML file
Then, the second GET request is automatically triggered by the server this time to an internal endpoint such as “http://127.0.0.1/secret”, attempting to read sensitive content.
Figure 7: Second HTTP GET request to access sensitive content
This chained behaviour clearly demonstrates the SSRF attack flow, where the attacker indirectly forces the server to access internal resources not meant to be exposed.
CVE-2023-46229 Strike in BreakingPoint
At Keysight Technologies, our Application and Threat Intelligence (ATI) team, the security researchers have examined the attack traffic pattern of CVE-2023-46229 and added a new (verified) Strike in ATI-2025-14 StrikePack released on July 16, 2025, as shown below –
Figure 8: New BPS Strike for CVE-2023-46229
Leverage Subscription Service to Stay Ahead of Attacks
Keysight's Application and Threat Intelligence subscription provides daily malware and bi-weekly updates of the latest application protocols and vulnerabilities for use with Keysight test platforms. The ATI Research Centre continuously monitors threats as they appear in the wild. BreakingPoint and in the future, other tools like CyPerf, now provide customers with access to attack campaigns for different advanced persistent threats, enabling them to test their currently deployed security controls' ability to detect or block such attacks.