SSRF in aerostack-mcp WhatsApp MCP Server via upload_media
First seen Jul 9, 2026 · Updated Jul 9, 2026 · CVSS 6.3
A server-side request forgery (SSRF) vulnerability exists in the aerostack-mcp project's mcp-whatsapp component, specifically in the upload_media function's media_url argument. A remote attacker can supply a malicious URL to force the MCP server to make unintended requests, potentially reaching internal network resources. The vendor has been notified but has not responded or patched the issue.
Technical Analysis
The upload_media function in mcp-whatsapp accepts a media_url parameter that is used to fetch remote media without adequate validation or restriction of the target host, protocol, or IP range. An attacker can supply URLs pointing to internal services (e.g., cloud metadata endpoints, internal APIs, localhost services) causing the MCP server to act as a proxy for unauthorized requests. Because this is exposed as an MCP tool, any agent or LLM orchestrator invoking upload_media inherits this exploitable code path, effectively turning a tool call into a network pivot point. The lack of versioning (rolling release) makes patch tracking and vulnerability scanning difficult for downstream consumers of the MCP server.
Affected Systems
aerostack-mcp, mcp-whatsapp; protocols: MCP
Detection Signatures
- Outbound requests from MCP server host to internal IP ranges (RFC1918, 169.254.169.254) originating from upload_media calls
- Unusual media_url values pointing to non-WhatsApp/non-CDN domains or internal hostnames
- Log entries showing tool invocation of upload_media with URL schemes other than https to expected CDN domains
- Repeated failed or redirected fetch attempts from the MCP server process
Remediation Steps
- 1
Validate and allowlist media_url
Restrict accepted URLs to a strict allowlist of trusted WhatsApp/CDN domains and reject internal, loopback, or link-local IP ranges before fetching.
- 2
Implement network egress controls
Use firewall rules or a proxy to block the MCP server host from reaching internal-only IP ranges and cloud metadata endpoints.
- 3
Pin and monitor the dependency
Since the project uses rolling releases with no version tags, pin to a specific commit hash, monitor the upstream repo for fixes, and re-audit before updating.
- 4
Escalate vendor engagement
Given the maintainer has not responded, consider forking with a patch, isolating the MCP server in a sandboxed network segment, or disabling upload_media until fixed.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.