SSRF in mcp-dominican-layer PDF Parsing Tool via pdfUrl Parameter

Technical Analysis

The parse-pdf function in src/index.ts takes a pdfUrl argument and fetches the resource server-side to parse it as a PDF, but does not restrict the target host, scheme, or IP range, enabling classic SSRF. Because MCP tools typically run with the network access and privileges of the host process, an AI agent instructed (directly or via prompt injection from untrusted content) to parse a PDF from an attacker-controlled URL can be coerced into making the server issue requests to internal-only endpoints (e.g., cloud metadata services, internal APIs, localhost admin panels). This crosses the boundary from 'agent tool that fetches user-supplied documents' into 'network pivot point,' letting an external actor use the MCP server as a proxy into otherwise unreachable infrastructure. The attack requires no authentication beyond the ability to supply a URL argument to the tool, and a working exploit is already public, meaning it can be operationalized quickly against unpatched instances.

Affected Systems

mcp-dominican-layer; protocols: MCP

Detection Signatures

• Outbound HTTP/HTTPS requests from the MCP host to unexpected internal IP ranges (RFC1918, 169.254.169.254, localhost) originating from the parse-pdf tool call
• Tool invocation logs showing pdfUrl values pointing to non-public or non-allowlisted hosts
• Unusual DNS resolution requests for internal hostnames triggered by PDF-parsing activity
• Repeated or automated calls to parse-pdf with varying internal-looking URLs (scanning behavior)

Remediation Steps

1. 1

   Patch or replace the component

   Since the maintainer has not responded, consider forking, patching pdfUrl validation yourself, or replacing mcp-dominican-layer with an alternative PDF-parsing MCP server that validates URLs.

2. 2

   Enforce URL allowlisting

   Restrict pdfUrl to a defined allowlist of trusted domains/schemes and explicitly block private IP ranges, link-local addresses, and cloud metadata endpoints (169.254.169.254).

3. 3

   Network egress controls

   Deploy the MCP server behind a network policy that denies outbound requests to internal/private address space, forcing all external fetches through a controlled proxy.

4. 4

   Sandbox tool execution

   Run the PDF-parsing tool in an isolated network namespace or container with no route to internal services, limiting SSRF blast radius even if exploited.

5. 5

   Monitor and alert

   Add logging/alerting on outbound requests from the MCP server to non-allowlisted hosts, and track tool argument values for anomalous URLs.