Enviar #866273: dmitriiweb article-scraper-mcp Latest Server-Side Request Forgery

## Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in the `article-scraper-mcp` server implementation.
The root cause is that the `url` parameter in the `fetch_article` MCP tool is only validated for basic URL format and then passed directly to `requests.get()`.
Because there is no destination allowlisting or network boundary validation, the server process can be induced to send HTTP requests to attacker-controlled or internal targets (for example localhost or private network services).

## Details
The MCP server exposes `fetch_article(url: str)` to fetch and parse article content.
Although `validate_url()` checks URL format (`regex + urlparse`), it does not enforce destination restrictions.
This means attacker-controlled tool input can reach the HTTP request sink directly.

### Vulnerable Code

Version: Latest
File: `news_scraper_mcp/server.py`

```python
def validate_url(url: str) -> bool:
if not url or not isinstance(url, str):
return False

if not URL_PATTERN.match(url):
return False

try:
result = urlparse(url)
return all([result.scheme, result.netloc])
except Exception:
return False

@app.tool()
def fetch_article(url: str) -> dict[str, Any]:
if not validate_url(url):
raise ValueError(f"Invalid URL provided: {url}")

response = requests.get(url, timeout=15, headers={"User-Agent": USER_AGENT})
response.raise_for_status()
```

Current validation does not restrict:
- destination hostname/domain
- resolved IP range (loopback/private/link-local/metadata)
- destination port
- redirect targets
As a result, attacker-controlled `url` input reaches the outbound request sink directly.

### Data Flow (source -> sink)

1. MCP client invokes `tools/call` for `fetch_article` with attacker-controlled `url`.
2. MCP server receives `url` argument in `fetch_article`.
3. Server executes `requests.get(url, timeout=15, headers={"User-Agent": USER_AGENT})`.
4. Outbound request is sent from server network context to attacker-selected destination.
Malicious attackers can inject malicious tool parameters through methods such as prompt/message injection or hijacking MCP client behavior, thereby triggering SSRF.

## Using MCP Inspector (Proof of Concept)

### Prerequisites
- Dependencies installed for `article-scraper-mcp`
- MCP Inspector available (`npx @modelcontextprotocol/inspector`)
- Local HTTP listener to capture requests

### Steps
1. Start a local receiver endpoint:
python -m http.server 8000

2. Start Inspector with the vulnerable server: 、
npx @modelcontextprotocol/inspector python "D:/MCP/article-scraper-mcp/main.py"

3. In Inspector:
- Select transport `stdio`
- Command: `python`
- Args: `D:/MCP/mcp.so/d/article-scraper-mcp/main.py`
- Click `Connect`
- Open `Tools`
- Select `fetch_article`

4. Use payload:
http://127.0.0.1:8000/ssrf-test
then, click Run Tool
5. On the local receiver terminal (`python -m http.server 8000`), a new request appears, confirming SSRF.

## Impact
Server-Side Request Forgery (SSRF).
Potential risks include:
- internal network probing from server context
- access attempts to localhost/internal services
- access attempts to cloud metadata endpoints
- controlled outbound callbacks to attacker infrastructure

• Fuente: ⚠️ https://github.com/dmitriiweb/article-scraper-mcp/issues/3
• Usuario: skywings (UID 98274)
• Sumisión: 2026-06-23 14:11 (hace 2 meses)
• Moderación: 2026-08-09 09:31 (2 months later)
• Estado: Aceptado
• Entrada de VulDB: 387259 [dmitriiweb article-scraper-mcp 1.0.0 server.py fetch_article url escalada de privilegios]
• Puntos: 20