Description

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through tools/list, and invoke execute_command with a valid UFO_MCP_API_KEY to read files or execute allowed operating system commands as the victim's user. This issue is fixed in version 3.0.8.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-21T21:17:01.350Z",
  "pubdate": "2026-08-21T21:17:01.350Z",
  "executiveSummary": "An arbitrary command execution and information disclosure vulnerability exists in the Microsoft UFO open-source framework prior to version 3.0.8.\nThe vulnerability stems from a missing validation mechanism for critical HTTP request headers within the Model Context Protocol (MCP) server implementation located at ufo/client/mcp/http_servers/linux_mcp_server.py.\nAn unauthenticated attacker leveraging an attacker-controlled web page can exploit this weakness via DNS rebinding attacks to bypass localhost binding restrictions on port 8010.\nSuccessful exploitation allows the adversary to interact with the local /mcp endpoint, enumerate available tool schemas through the tools/list method, and execute the execute_command function.\nAlthough a valid UFO_MCP_API_KEY is required for execution, the lack of origin validation enables malicious web applications to leverage the victim's local trust context and session parameters.\nThe impact includes reading arbitrary files and executing operating system commands with the privileges of the victim user running the affected application.\nThis vulnerability represents a significant risk to local machine integrity and user data confidentiality, requiring immediate remediation.",
  "technicalDetails": "The vulnerability resides in the Microsoft UFO framework, specifically within the vulnerable component ufo/client/mcp/http_servers/linux_mcp_server.py, which affects all versions prior to 3.0.8.\nThe root cause of the vulnerability is the improper restriction of operations within the FastMCP streamable HTTP server. The server binds to localhost:8010 but fails to validate critical security headers such as Host, Origin, and Sec-Fetch-Site during incoming HTTP requests.\nNetwork exposure is ostensibly limited to the local loopback interface (localhost:8010), which under normal circumstances would prevent external web applications from interacting with the service.\nHowever, because the application lacks proper HTTP header validation, an external attacker can bypass this boundary using a DNS rebinding attack.\nThe attack flow proceeds as follows: First, the attacker entices the victim to visit a malicious web page controlled by the adversary. Second, the malicious page performs a DNS rebinding attack, causing the browser to resolve a domain under the attacker's control to the local loopback IP address (127.0.0.1). Third, the malicious web page initiates cross-origin HTTP requests directly to http://localhost:8010/mcp.\nBecause the server does not validate the Origin or Host headers, it processes these cross-origin requests despite originating from an external web context.\nOnce communication is established with the /mcp endpoint, the attacker's script can interact with the Model Context Protocol server. The attacker can enumerate available tool schemas by calling the tools/list method to discover exposed system capabilities.\nFollowing schema enumeration, the attacker can invoke the execute_command function. While exploitation requires a valid UFO_MCP_API_KEY, an attacker who has obtained or inferred this key—or in scenarios where local scripts expose it to the environment—can successfully authorize commands.\nThe payload behavior and post-exploitation impact allow the adversary to read arbitrary files accessible to the victim user or execute operating system commands under the security context of the user running the Microsoft UFO framework, leading to complete local compromise."
}