OWL DocumentProcessingToolkit SSRF via Prompt-Injected URLs

Technical Analysis

The vulnerability lies in a tool function that accepts URLs and performs HTTP fetches on behalf of the agent with no allowlist, denylist, or network-layer restrictions on scheme (e.g., file://, gopher://), hostname, or IP range (including RFC1918 private ranges and link-local metadata IPs like 169.254.169.254). An attacker can achieve this either through direct tool invocation or indirectly via prompt injection embedded in a document the agent is asked to process, causing the LLM to autonomously construct and pass a malicious URL to the tool. Because the fetched content is returned into the agent's context window, this creates a two-stage risk: SSRF-driven access to internal infrastructure and cloud credentials, followed by potential secondary prompt injection if the fetched internal content also contains adversarial instructions. This crosses the boundary between untrusted external input (document content) and privileged internal network access performed by the tool layer on the agent's behalf.

Affected Systems

OWL

Detection Signatures

• Tool calls to extract_document_content with URL parameters pointing to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost, 127.0.0.1, or 169.254.169.254
• URL schemes other than http/https passed to document fetch tools (file://, gopher://, dict://, ftp://)
• Unexpected outbound requests from agent runtime to internal-only hostnames or IP literals
• Log entries showing document content containing embedded instructions that reference URLs or fetch commands
• Anomalous tool output size or content type mismatches (e.g., JSON/XML metadata responses where document text was expected)

Remediation Steps

1. 1

   Implement URL allowlisting

   Restrict extract_document_content to fetch only from an explicit allowlist of trusted domains/schemes (http/https only), rejecting IP literals and internal ranges.

2. 2

   Block private and reserved IP ranges

   Add network-layer or application-layer filtering to reject requests to RFC1918, loopback, link-local, and cloud metadata IP addresses before any fetch occurs.

3. 3

   Resolve and re-validate DNS

   Perform DNS resolution prior to connecting and validate the resolved IP against the blocklist to prevent DNS rebinding bypasses.

4. 4

   Sandbox outbound tool network access

   Run document-fetching tools in a network-isolated environment or egress proxy that enforces destination restrictions independent of application logic.

5. 5

   Sanitize and isolate fetched content

   Treat fetched document content as untrusted data; strip or flag embedded instructions before injecting it into the agent's context to prevent secondary prompt injection.

6. 6

   Upgrade OWL and monitor advisories

   Apply vendor patches for CVE-2026-85675 as soon as available and monitor for related fixes across other OWL toolkit tools with similar URL-handling patterns.