jshookmcp SSRF Policy Bypass via ICMP/Traceroute Tools
First seen Aug 13, 2026 · Updated Aug 13, 2026 · CVSS 4.3
The jshookmcp MCP server enforces an SSRF policy that blocks access to private and internal network addresses for most of its raw network tools, but the ICMP probe and traceroute tools bypass this policy entirely. This lets any MCP client with access to the network domain map internal network topology and probe internal hosts, even when private network access is explicitly disabled by policy.
Technical Analysis
The jshookmcp server centralizes SSRF protections in an authorization policy that gates HTTP, TCP, and TLS RTT tools, blocking loopback, link-local, private, and reserved IP ranges unless explicitly authorized. However, the ICMP probe and traceroute tools resolve the target hostname/IP and invoke native ICMP/traceroute system calls directly, skipping the centralized policy check. An MCP client (or a malicious/compromised AI agent using this server) can therefore issue traceroute or ICMP ping requests against internal RFC1918 addresses, loopback, or link-local ranges to perform internal reachability and network topology mapping from the server's network vantage point. This crosses a trust boundary because the tool description implies uniform SSRF protection across all network tools, but the enforcement gap in two specific tools grants a reconnaissance primitive that the policy was explicitly designed to prevent.
Affected Systems
jshookmcp; protocols: MCP
Detection Signatures
- MCP tool call logs showing icmp_probe or traceroute invocations targeting RFC1918, 127.0.0.0/8, 169.254.0.0/16, or other reserved ranges
- Outbound ICMP echo requests or traceroute packets originating from MCP server host toward internal-only subnets
- Mismatch between SSRF authorization policy logs (deny) for HTTP/TCP tools and allowed ICMP/traceroute calls to same targets
- Unexpected internal network scanning activity correlated with AI agent/MCP client sessions
Remediation Steps
- 1
Upgrade jshookmcp
Update to version 0.3.2 or later, which fixes the ICMP/traceroute SSRF policy bypass.
- 2
Enforce centralized authorization for all network tools
Ensure any custom or forked MCP network tools route target resolution and connection attempts through the same SSRF authorization policy used by other raw network primitives, with no exceptions for ICMP/traceroute sinks.
- 3
Restrict network domain access
Limit which MCP clients/agents can enable the network domain, and apply network-level egress controls (firewall rules) preventing the MCP server host from reaching internal/private address ranges regardless of application-level policy.
- 4
Audit and monitor tool invocations
Log and monitor all ICMP, traceroute, and raw network tool calls for targets in private/reserved IP space, alerting on policy bypass attempts.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.