Srikanthramu

**Nome do Software Vulnerável e Versões Afetadas** mcp-security versões anteriores a 0.1.9 **Description** O framework mcp-security falha ao implementar as mitigações obrigatórias de Server-Side Request Forgery (SSRF) — uma falha onde um invasor pode induzir o servidor a fazer requisições para um local não pretendido — conforme descrito nas especificações de segurança do Model Context Protocol (MCP). O framework processa URLs não confiáveis para descoberta e metadados relacionados ao OAuth sem verificar se os alvos são maliciosos ou internos à rede. Este problema afeta especificamente instalações onde o Dynamic Client Registration (DCR) está habilitado através da propriedade `spring.ai.mcp.client.authorization.dynamic-client-registration.enabled`. O DCR não valida URLs expostas por Servidores MCP, como a URL de metadados do recurso protegido e a URL do servidor de autorização, nem valida endpoints OAuth2 de Servidores de Autorização. **Recommendations** Atualize para a versão 0.1.9. Como alternativa temporária, forneça um `McpOAuth2ClientManager` personalizado ao realizar DCR. Forneça subclasses personalizadas para `McpMetadataDiscoveryService` e `DynamicClientRegistrationService` se estiverem em uso. Implemente a filtragem de URLs fornecendo as implementações padrão dessas classes com um `RestClient` que utilize um `ClientHttpRequestInterceptor`.

**Name of the Vulnerable Software and Affected Versions** MCP Java SDK versions prior to 1.0.1 MCP Java SDK versions prior to 1.1.1 **Description** The MCP Java SDK contains a hardcoded wildcard Cross-Origin Resource Sharing (CORS) configuration, specifically setting `Access-Control-Allow-Origin` to '*'. This allows cross-origin reads, potentially exposing sensitive information like session IDs via Server-Sent Events (SSE). An attacker-controlled web page can instruct a victim's browser to open a GET request to an internal server endpoint. Because of the wildcard CORS setting, the attacker's page can receive event data, including the session ID, and then use the victim's browser to relay a POST request to that endpoint. The Python SDK does not exhibit this behavior, maintaining the browser's default same-origin policy. The vulnerable code is located in `HttpServletSseServerTransportProvider.java` at line 289 and `HttpServletStreamableServerTransportProvider.java` at line 525. **Recommendations** For versions prior to 1.0.1, server implementers should add a CORS filter at the servlet filter or Spring Security layer to manage cross-origin access. For versions prior to 1.1.1, server implementers should add a CORS filter at the servlet filter or Spring Security layer to manage cross-origin access.

**Name of the Vulnerable Software and Affected Versions** MCP Ruby SDK versions prior to 0.9.2 **Description** The Ruby SDK for Model Context Protocol servers and clients contains a session hijacking issue in its `streamable http transport.rb` implementation. An attacker obtaining a valid session ID can hijack a victim's Server-Sent Events (SSE) stream, intercepting all real-time data. The issue stems from a lack of session-to-user identity binding, ownership validation when establishing SSE connections, and protection against multiple simultaneous connections to the same session. Specifically, the `store stream for session` function overwrites existing streams for a session ID, allowing an attacker to replace a legitimate user's stream with their own. This allows the attacker to receive all subsequent data intended for the victim. The Python SDK includes protection against this by rejecting duplicate SSE connections. **Recommendations** Versions prior to 0.9.2 should be updated to version 0.9.2 or later.