MissionSquad mcp-api SSRF via dcrClients.ts

Technical Analysis

The vulnerability resides in an unnamed function within src/services/dcrClients.ts, likely part of the OAuth/OIDC dynamic client registration (DCR) flow used by the MCP server to register or interact with external identity/client endpoints. Because the affected function does not adequately validate or restrict the destination of outbound requests derived from client-supplied input, an attacker can supply a malicious URL (e.g., pointing to internal metadata services, localhost, or private network ranges) that the server will fetch on the attacker's behalf. This crosses the trust boundary between the MCP server and its backend network, allowing an external actor to pivot into internal infrastructure, enumerate internal services, or exfiltrate data reachable only from the server's network position. Since MCP servers often broker access to sensitive tools and credentials for AI agents, a successful SSRF could be leveraged to reach internal APIs or cloud metadata endpoints that an agent would not normally be permitted to access directly.

Affected Systems

MissionSquad mcp-api; protocols: MCP

Detection Signatures

• Outbound HTTP requests from the mcp-api server host to unexpected internal IP ranges (e.g., 169.254.169.254, 127.0.0.1, RFC1918 addresses) originating from dcrClients.ts logic
• Unusual client registration requests containing URLs pointing to internal or non-standard hosts
• Log entries showing DCR-related fetches to endpoints not on an allow-list
• Spikes in requests to cloud metadata services correlated with MCP server activity

Remediation Steps

1. 1

   Upgrade mcp-api

   Update MissionSquad mcp-api to version 1.11.10 or later, which contains the fix (commit f068ab4ad6f0907ac7001b995588c2673f11a755).

2. 2

   Restrict outbound network access

   Apply network-level egress controls (firewall rules, allow-lists) so the MCP server host cannot reach internal management interfaces, metadata services, or arbitrary external hosts.

3. 3

   Validate DCR client URLs

   Ensure dynamic client registration endpoints validate and sanitize any user- or client-supplied URLs before the server performs requests to them, rejecting internal/loopback/link-local addresses.

4. 4

   Monitor and audit outbound requests

   Enable logging and alerting on outbound requests made by the MCP server, particularly those tied to client registration or configuration flows.