Meta Ads MCP Server-Side Request Forgery via upload_ad_image Tool

Technical Analysis

The upload_ad_image tool passes an attacker-controlled image_url parameter into try_multiple_download_methods(), which uses httpx.AsyncClient with follow_redirects=True and no restrictions on scheme, hostname, or resolved IP address. Because Meta credential validation happens after the image download attempt, a caller can supply a placeholder authorization value to trigger the request without valid Meta Ads credentials. This allows the MCP server to be used as an SSRF proxy, reaching loopback services, RFC1918 private addresses, cloud metadata endpoints (e.g., AWS IMDS), or attacker-controlled hosts that redirect to internal targets. The entry point is the exposed MCP tool interface itself, and the attacker gains the ability to exfiltrate internal data, invoke unintended internal APIs, or disrupt reachable services — crossing from the AI-agent tool layer into the underlying network infrastructure trust boundary.

Affected Systems

Meta Ads MCP; protocols: MCP

Detection Signatures

• Outbound HTTP/HTTPS requests from MCP server process to loopback (127.0.0.1), link-local (169.254.169.254), or RFC1918 addresses following upload_ad_image tool invocation
• MCP tool calls with image_url parameters pointing to non-public or unexpected hosts
• Authorization header present but not matching valid Meta API token format prior to successful auth check
• Unusual redirect chains observed in httpx client logs terminating at internal-only endpoints
• MCP server logs showing image download attempts preceding any Meta credential validation step

Remediation Steps

1. 1

   Upgrade Meta Ads MCP

   Update to version 1.0.115 or later, which fixes the SSRF vulnerability in the upload_ad_image tool.

2. 2

   Validate and restrict URL destinations

   Implement allowlisting of permitted schemes (https only) and hostnames, and block requests resolving to loopback, private-network, or link-local/metadata IP ranges before performing any outbound fetch.

3. 3

   Disable automatic redirect following

   Set follow_redirects=False or strictly re-validate the destination of every redirect hop against the same allowlist and IP restrictions.

4. 4

   Enforce credential validation before resource access

   Reorder logic so Meta credential/authorization validation occurs prior to any network request triggered by tool input, preventing unauthenticated SSRF attempts.

5. 5

   Network segmentation for MCP server

   Deploy the MCP server in a network segment without access to cloud metadata endpoints or sensitive internal services, using egress filtering as defense in depth.