SSRF in mcp-dominican-layer MCP Server via parse-csv Tool

Technical Analysis

The parse-csv tool in src/index.ts passes an attacker-controlled csvUrl parameter directly to axios.get() without allow-listing schemes, hosts, or IP ranges, enabling the server process to be used as an SSRF proxy. Entry point is any caller of the MCP tool (an LLM agent following instructions, a malicious prompt, or a compromised upstream client) that can set the csvUrl argument, meaning prompt injection or tool-chaining could trigger this without direct human involvement. An attacker gains the ability to probe internal network topology, reach cloud metadata services (e.g., 169.254.169.254) to steal credentials, interact with internal-only APIs, or perform port scanning, all pivoting through the trusted MCP server's network position. This crosses the tool boundary because the MCP protocol treats tool inputs as data, but the tool implementation fails to treat that data as untrusted before making outbound network calls, turning an agent capability into a network attack primitive.

Affected Systems

mcp-dominican-layer; protocols: MCP

Detection Signatures

• Outbound HTTP/HTTPS requests from MCP server host to unexpected internal IP ranges (RFC1918, 169.254.169.254, localhost) originating from parse-csv tool invocations
• Log entries showing csvUrl parameter values pointing to non-public or internal hosts
• Unusual axios.get requests with schemes other than http/https (file://, gopher://, dict://)
• Spikes in outbound connection attempts correlated with MCP tool call logs referencing 'parse-csv'
• Repeated failed or timing-varied requests suggesting internal network scanning via the tool

Remediation Steps

1. 1

   Validate and restrict csvUrl input

   Implement strict allow-listing of permitted domains/schemes for the csvUrl parameter; reject private IP ranges, localhost, link-local addresses, and non-HTTP(S) schemes before making the request.

2. 2

   Deploy egress network controls

   Restrict outbound network access from the MCP server host so it cannot reach internal management interfaces, cloud metadata endpoints, or other sensitive internal services.

3. 3

   Patch or replace the vulnerable tool

   Since the project has not responded to the disclosed issue, consider forking with a fix, disabling the parse-csv tool, or migrating to an alternative MCP server implementation with proper input validation.

4. 4

   Add SSRF-aware proxy/DNS resolution checks

   Use a validating HTTP client wrapper that resolves DNS and re-checks the resolved IP against a blocklist immediately before connecting, to prevent DNS rebinding bypasses of allow-lists.

5. 5

   Monitor and alert on tool network activity

   Instrument the MCP server to log and alert on outbound requests to internal/reserved IP ranges triggered by tool executions.