Listen to this Post
The vulnerability arises from the default configuration of HTTP-based servers in the MCP TypeScript SDK, which lacks DNS rebinding protection. When using StreamableHTTPServerTransport or SSEServerTransport on localhost without authentication, and without explicitly enabling enableDnsRebindingProtection, the server does not validate the Host header. This allows malicious websites to perform DNS rebinding attacks: the attacker’s domain initially resolves to a remote IP but later rebinds to localhost (127.0.0.1). Since the same-origin policy is bypassed, the malicious site can send HTTP requests directly to the local MCP server. These requests can invoke tools or access resources exposed by the server, such as local files or functions, under the user’s permissions. The attack exploits the trust between the browser and localhost, assuming local services are safe. Servers using stdio transport are unaffected. The fix involves enforcing Host header validation to reject requests not intended for localhost.
dailycve form:
Platform: MCP TypeScript SDK
Version: Before 1.24.0
Vulnerability: DNS rebinding attack
Severity: High
Date: Not disclosed
Prediction: Patched in 1.24.0
What Undercode Say:
Analytics
Showing bash commands and codes related to the blog
Start vulnerable MCP HTTP server (example) npx @modelcontextprotocol/sdk server --transport http --no-auth
// Vulnerable server code snippet
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk';
const transport = new StreamableHTTPServerTransport({ / no DNS rebinding protection / });
Check local server access curl -H "Host: malicious.com" http://localhost:8000/tools
how Exploit:
Attacker sets up malicious website with DNS rebinding to localhost. User visits site, JavaScript sends requests to local MCP server, bypassing same-origin policy, invoking exposed tools or resources.
Protection from this CVE
Update to SDK version 1.24.0. Use hostHeaderValidation middleware for custom Express servers. Enable enableDnsRebindingProtection option.
Impact:
Unauthorized tool invocation. Local resource access. Potential data exposure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
