Listen to this Post
The SSRF vulnerability in fetch-mcp server v1.0.2 and prior stems from insufficient validation of user-supplied URLs before they are used to make outgoing HTTP requests. The vulnerability specifically allows an attacker to bypass the server’s private IP address filter. This filter is intended to block requests to internal (RFC 1918) network resources. The bypass is achieved by supplying a URL with an IP address encoded in an alternate format, such as octal (e.g., 0177.0.0.1 for 127.0.0.1) or hexadecimal (e.g., 0x7f.0.0.1). The server’s validation logic performs a simple string match against canonical dotted-decimal IP notation but fails to normalize these alternative encodings before applying the blocklist. Consequently, when the request is passed to the underlying fetching library (like node-fetch), the library correctly resolves the octal or hex notation to a standard IP address and proceeds to connect to the restricted internal endpoint. This enables an attacker to probe and interact with services on the server’s local loopback or internal network that were intended to be inaccessible, potentially leading to information disclosure or further exploitation of internal systems.
Platform: Fetch MCP Server
Version: v1.0.2 and before
Vulnerability: SSRF Bypass
Severity: Moderate
Date: Dec 9-10, 2025
Prediction: Patch expected by early Jan 2026.
What Undercode Say:
curl -X POST https://target-mcp-server/tool -d ‘{“name”:”fetch”,”arguments”:{“url”:”http://0x7f.0.0.1:8080/admin”}}’
python3 -c “import requests; print(requests.get(‘http://0177.0.0.1:22’).text[:50])” Banner grab
npm list fetch-mcp Check installed version
grep -r “fetch\|request” src/ –include=”.js” Find endpoints
How Exploit:
1. Identify Tool Endpoint.
2. Craft Payload with Octal/IP.
3. Bypass IP Filter.
4. Access Internal Service.
Protection from this CVE:
Update fetch-mcp library.
Implement strict URL validation.
Use allowlists, not blocklists.
Network segmentation for services.
Impact:
Internal network access.
Sensitive data exposure.
Potential lateral movement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
