提出 #868928: EnzoVezzaro mcp-dominican-layer Latest Server-Side Request Forgery

Summary
A Server-Side Request Forgery (SSRF) vulnerability exists in the mcp-dominican-layer MCP server implementation.
The root cause is that the pdfUrl parameter in the parse-pdf MCP tool is only validated for basic URL format (z.string().url()) and then passed directly to axios.get().
Because there is no destination allowlisting or network boundary validation, the server process can be induced to send HTTP requests to attacker-controlled or internal targets (for example localhost or private network services).

Details
The MCP server exposes parse-pdf(pdfUrl: string) to fetch and parse PDF content from a remote URL.
Although z.string().url() checks URL format via Zod, it does not enforce destination restrictions.
This means attacker-controlled tool input can reach the HTTP request sink directly.

Vulnerable Code
Version: Latest
File: src/index.ts

server.tool("parse-pdf", {
pdfUrl: z.string().url()
}, async ({ pdfUrl }) => {
try {
const response = await axios.get(pdfUrl, { responseType: 'arraybuffer' });
const data = await pdf(response.data);
return {
content: [{ type: "text", text: data.text }]
};
} catch (error: any) {
// ...
}
});
Current validation does not restrict:

destination hostname/domain
resolved IP range (loopback/private/link-local/metadata)
destination port
redirect targets
As a result, attacker-controlled pdfUrl input reaches the outbound request sink directly.

Data Flow (source → sink)
MCP client invokes tools/call for parse-pdf with attacker-controlled pdfUrl.
MCP server receives pdfUrl argument in the parse-pdf handler.
Server executes axios.get(pdfUrl, { responseType: 'arraybuffer' }).
Outbound request is sent from server network context to attacker-selected destination.
Response body is parsed as PDF and returned to the caller (full-read SSRF).
Malicious attackers can inject malicious tool parameters through methods such as prompt/message injection or hijacking MCP client behavior, thereby triggering SSRF.

Using MCP Inspector (Proof of Concept)
Prerequisites
Dependencies installed for mcp-dominican-layer (npm install && npm run build)
MCP Inspector available (npx @modelcontextprotocol/inspector)
Local HTTP listener to capture requests
Steps
Start a local receiver endpoint: python -m http.server 8000
Start Inspector with the vulnerable server: npx @modelcontextprotocol/inspector node build/index.js

In Inspector:

Select transport stdio
Command: node
Args: build/index.js
Click Connect
Open Tools
Select parse-pdf
Use payload: http://127.0.0.1:8000/ssrf-test
Click Run Tool
On the local receiver terminal (python -m http.server 8000), a new request appears, confirming SSRF.

Impact
Server-Side Request Forgery (SSRF).

• ソース: ⚠️ https://github.com/EnzoVezzaro/mcp-dominican-layer/issues/3
• ユーザー: skywings (UID 98274)
• 送信: 2026年06月25日 09:09 (2 月 ago)
• モデレーション: 2026年08月13日 16:58 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 389530 [EnzoVezzaro mcp-dominican-layer 迄 39dd373786712650097ad31db27d5c477c8f9c82 PDF Parsing src/index.ts parse-pdf pdfUrl 特権昇格]
• ポイント: 20