PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

Summary

PraisonAI's AgentMail bot, when run in webhook (or hybrid) mode, starts an aiohttp webhook server bound to 0.0.0.0 and processes inbound message.received events without verifying any signature/HMAC and without authentication. The sender address and message body are taken directly from the attacker-controlled request body, so any network peer can inject messages into the agent with a spoofed sender (bypassing sender allow/block lists) and have the agent process the content and reply to an attacker-chosen address. Sibling bots (linear.py, whatsapp.py) fail closed when no secret is configured; AgentMail omits the check entirely. Runtime-confirmed; severity Medium.

Details

Affected component

• Package: praisonai 4.6.63. File: src/praisonai/praisonai/bots/agentmail.py (AgentMailBot, webhook/hybrid mode).

Vulnerable code / root cause

Path: src/praisonai/praisonai/bots/agentmail.py

Function: _start_webhook_mode / _handle_email_webhook / _handle_message

Snippet:

# _start_webhook_mode: binds all interfaces
self._webhook_site = web.TCPSite(self._webhook_runner, "0.0.0.0", self._webhook_port)

# _handle_email_webhook: no signature/HMAC check, no auth
body = await request.json()
if body.get("type") != "message.received":
    return web.Response(status=200, text="OK")
asyncio.create_task(self._process_webhook_payload(body))   # dispatch attacker body
return web.Response(status=200, text="OK")

# _handle_message: agent processes content, replies to attacker-controlled sender
response = await self._session.chat(self._agent, sender_id, body, ...)
await self.send_message(channel_id=sender_id, ...)

Issue: attacker-controlled input is the raw webhook JSON (from, extracted_text, subject). The guard that should exist is provider signature verification — there is none here (no svix/HMAC, no webhooks_require_verification() call). The sink is self._session.chat(self._agent, ...) (agent invocation) and send_message(channel_id=sender_id, ...) (reply to the spoofed sender). Sibling handlers src/praisonai/praisonai/bots/linear.py and bots/whatsapp.py call webhooks_require_verification() and reject when no secret is set — AgentMail does not, so it fails open.

Attack flow