SSRF in mcp-rdf-explorer MCP Server via explore_url

Technical Analysis

The explore_url function in src/mcp-rdf-explorer/server.py accepts a user-supplied URL parameter without adequate validation or restriction, passing it directly into an outbound HTTP request. This allows an attacker acting through the MCP tool interface to redirect the server's requests to internal network resources, cloud metadata endpoints, or other unintended targets, crossing the trust boundary between the tool-calling agent and the underlying server infrastructure. Because MCP tools are often invoked autonomously by LLM agents based on model-driven reasoning, an attacker who can influence the URL argument (via prompt injection or malicious tool input) can pivot from the agent layer into internal network reconnaissance or data exfiltration. The exploit is publicly available and remotely exploitable without authentication details specified, increasing the risk of opportunistic exploitation.

Affected Systems

mcp-rdf-explorer; protocols: MCP

Detection Signatures

• Outbound requests from MCP server processes to internal IP ranges (169.254.169.254, 127.0.0.1, RFC1918 addresses) originating from explore_url tool calls
• Unexpected URL schemes (file://, gopher://, dict://) passed as the 'url' argument
• Logs showing explore_url invoked with non-RDF/non-expected target hosts
• Repeated tool calls with sequential or scanning-pattern URLs indicating SSRF probing

Remediation Steps

1. 1

   Patch or replace component

   Since the vendor is unresponsive, fork or patch mcp-rdf-explorer to add strict URL validation, allow-listing of permitted domains/schemes, and blocking of private/link-local IP ranges before making outbound requests.

2. 2

   Network egress controls

   Deploy the MCP server behind a proxy or firewall that blocks outbound requests to internal/metadata IP ranges regardless of application-layer validation.

3. 3

   Input sanitization at tool boundary

   Add server-side validation of the url argument passed to explore_url, rejecting non-http(s) schemes and resolving hostnames to check against a deny-list prior to request execution.

4. 4

   Isolate and monitor MCP server

   Run the affected MCP server in a sandboxed/isolated network segment with no access to sensitive internal services, and monitor outbound connections for anomalies.

5. 5

   Discontinue use pending fix

   Given the unresponsive vendor and public exploit, consider disabling or removing mcp-rdf-explorer from production agent pipelines until a verified patch is available.