Listen to this Post
This vulnerability is a DNS rebinding attack against the MCP Python SDK (mcp on PyPI). In versions before 1.23.0, HTTP-based servers created with the SDK did not have DNS rebinding protection enabled by default. A malicious actor could host a website that, when visited by a user, performs a DNS rebinding attack. This attack tricks the user’s browser into believing that a domain name resolves to a remote, attacker-controlled server when it initially does, but later re-binds to resolve to localhost (127.0.0.1). This bypasses the browser’s same-origin policy, which normally prevents websites from making requests to localhost. Consequently, the malicious JavaScript from the attacker’s site can send requests directly to an MCP server running locally on the user’s machine. For this exploit to succeed, the local MCP server must be running without authentication (contrary to security best practices) and using an HTTP or Server-Sent Events (SSE) transport. If these conditions are met, the attacker can invoke any tools or access resources that the vulnerable local MCP server exposes, potentially leading to unauthorized local system access or data exfiltration.
Platform: MCP Python SDK
Version: < 1.23.0
Vulnerability : DNS Rebinding
Severity: High
date: 2025-02-12
Prediction: 2025-02-15
What Undercode Say:
Analytics
Check installed version of MCP SDK
pip show mcp
Example of running a vulnerable HTTP server (for illustration only)
The lack of `TransportSecuritySettings` enables the flaw.
from mcp.server import Server
import asyncio
This server prior to 1.23.0 would be vulnerable
server = Server("example")
... tool setup ...
Running without explicit security settings is vulnerable
How Exploit:
1. Attacker sets up a malicious website.
- User with a vulnerable local MCP server visits the site.
3. Malicious script performs DNS rebinding attack.
4. Script bypasses same-origin policy, targeting localhost.
- Script sends requests to the local MCP server.
6. Attacker invokes server’s tools arbitrarily.
Protection from this CVE
1. Upgrade MCP SDK.
2. Enable authentication for servers.
3. Use stdio transport.
Impact:
Unauthorized tool invocation
Local resource access
Security policy bypass
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
