Description

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neither the host name nor the address it resolves to. Loopback, link-local and private ranges therefore passed, including the address cloud providers use to serve instance metadata. The unchecked URL was handed to the web-browser actor and the fetched document was returned in the tool response, so any caller of the MCP server could make it request an endpoint reachable only from the host and read the result, including instance credentials. Version 0.9.12 removes the tool.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-27T17:20:51.493Z",
  "pubdate": "2026-08-27T17:20:51.493Z",
  "executiveSummary": "The get-html-skeleton tool contained a Server-Side Request Forgery (SSRF) vulnerability due to insufficient URL validation.\nBy failing to restrict the target host or address space, the application allowed requests to be made against internal network resources, including sensitive cloud instance metadata services.\nAn unauthenticated attacker could leverage this vulnerability to gain unauthorized access to internal data, potentially compromising cloud instance credentials or sensitive configuration information.\nThis vulnerability affected the get-html-skeleton tool within the MCP server codebase.\nThe risk is significant as it facilitates unauthorized lateral movement and information disclosure within the hosting environment.\nVersion 0.9.12 addresses this issue by removing the vulnerable tool entirely, effectively eliminating the attack vector.",
  "technicalDetails": "The root cause of the vulnerability lies in the inadequate validation logic implemented within the get-html-skeleton tool located in src/tools/common/get_html_skeleton.ts. The tool utilized the isValidHttpUrl function from src/utils/generic.ts to verify user-supplied input.\nThe validation logic solely checked for the presence of http or http schemes and ensured the input string could be parsed as a valid URL structure. Crucially, the implementation failed to inspect the resolved IP address or the hostname of the target URL. Consequently, the filter did not prohibit connections to loopback addresses (e.g., 127.0.0.1, ::1), link-local addresses (169.254.169.254), or RFC 1918 private network ranges.\nThe exploitation flow begins when an attacker supplies a malicious URL to the MCP server. Because the validation check passes for non-public addresses, the server-side code passes the unchecked URL directly to the web-browser actor responsible for performing the HTTP request. The tool then fetches the content from the specified internal endpoint and returns the raw response body to the caller.\nThis behavior enables an attacker to bypass perimeter security and interact directly with internal services reachable from the host machine. A primary target for such exploitation is the cloud instance metadata service (typically 169.254.169.254 in major cloud environments), which often exposes sensitive credentials, environment variables, and configuration metadata without requiring additional authentication. By crafting a request to these endpoints, an attacker can exfiltrate high-value sensitive information.\nThe vulnerability does not require authentication to the underlying service being queried, as the requests originate from the trusted MCP server host. This effectively converts the server into a proxy for arbitrary network requests within the server's internal context. Because the vulnerability was inherent to the logic of the get-html-skeleton tool, any version prior to 0.9.12 is vulnerable. The remediation implemented in version 0.9.12 involved the complete removal of the get-html-skeleton tool, which eliminates the SSRF surface entirely."
}