Description

@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, he network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network access. The policy is enforced by raw HTTP/TCP/TLS RTT tools, but the ICMP probe and traceroute tools resolve the target and invoke the native ICMP/traceroute sink directly. An MCP client with access to an active network domain can therefore ask the jshookmcp server to probe internal addresses even when local SSRF access is disabled for the other raw network tools. This exposes an internal reachability and route mapping primitive from the server network position. Version 0.3.2 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-13T15:19:41.563Z",
  "pubdate": "2026-08-13T15:19:41.563Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) authorization bypass vulnerability exists in the @jshookmcp/jshook Model Context Protocol (MCP) server prior to version 0.3.2.\nThe vulnerability allows an AI agent or MCP client to bypass central network domain authorization policies restricting access to private, loopback, link-local, and reserved IP addresses.\nWhile raw HTTP, TCP, and TLS Round Trip Time (RTT) tools correctly enforce the SSRF authorization policy, the ICMP probe and traceroute tools fail to validate targets against this security policy.\nThis architectural oversight exposes an internal network reachability and route mapping primitive directly from the server's network vantage point.\nAn attacker with access to an active network domain on the MCP server can leverage this discrepancy to probe internal network infrastructure, map internal routes, and discover services that should otherwise be isolated by local SSRF access controls.\nThe risk is mitigated by upgrading the affected package to version 0.3.2, which introduces comprehensive security policy enforcement across all network-related diagnostic tools.",
  "technicalDetails": "The vulnerability resides in the network domain handling of the @jshookmcp/jshook MCP server implementation affecting version 0.3.1 and prior.\nThe root cause is an inconsistent enforcement mechanism within the application's authorization boundary for network-based tool sinks.\nThe system implements a centralized SSRF authorization policy designed to intercept and block requests targeting private, loopback, link-local, and reserved address spaces unless an explicit authorization object grants private network access.\nThis authorization check is properly enforced for raw HTTP, TCP, and TLS RTT diagnostic tools.\nHowever, the ICMP probe and traceroute tools bypass this centralized authorization logic entirely.\nInstead of passing through the SSRF validation layer, these specific tools resolve the target address directly and invoke native ICMP and traceroute sinks.\nThe attack flow proceeds as follows: an authenticated MCP client with access to an active network domain issues a request to execute an ICMP probe or traceroute targeting a restricted internal IP address or private network segment.\nBecause local SSRF access controls are bypassed by the ICMP and traceroute sinks, the @jshookmcp/jshook server executes the probe from its internal network position.\nThe server then processes the native responses and returns reachability telemetry to the client.\nThis behavior exposes a powerful internal reachability and route mapping primitive.\nNo authentication or elevated privileges beyond standard access to an active network domain within the MCP environment are required to exploit this discrepancy.\nThe issue allows unauthorized network reconnaissance of internal infrastructure that is intended to be shielded from external exposure by the central SSRF policy."
}