pg-aiguide MCP Server DNS Rebinding Vulnerability

Technical Analysis

The MCP server's HTTP transport, instantiated via the shared httpServerFactory helper in src/httpServer.ts, did not pass the DNS-rebinding-protection flag that the underlying SDK already supports. Because the server accepted requests regardless of the Host header, an attacker could host a malicious webpage that uses DNS rebinding to make a victim's browser resolve an attacker-controlled domain to the loopback/local address where the MCP server listens. Once rebound, the browser's same-origin policy no longer prevents it from issuing arbitrary requests to the local MCP server, effectively turning the browser into a proxy that crosses the network boundary attackers normally cannot reach. This grants the attacker the ability to invoke MCP tools and capabilities exposed by the server as if they were a trusted local client, potentially leading to data exfiltration, unauthorized tool invocation, or further pivoting depending on what tools the MCP server exposes. Merely updating the SDK dependency would not fix this since the protection was available but simply never enabled in application code.

Affected Systems

pg-aiguide, MCP SDK (HTTP transport); protocols: MCP

Detection Signatures

• MCP server logs showing requests with unexpected or non-localhost Host headers targeting local bind address
• Absence of 'enableDnsRebindingProtection' or equivalent allow-list option in httpServerFactory configuration
• Unexpected inbound HTTP requests to MCP server port originating from browser User-Agent strings
• Requests to MCP endpoints with Host header mismatched against expected server hostname/IP
• Traffic correlating with recently registered or rotated DNS records resolving to loopback/private IP ranges

Remediation Steps

1. 1

   Upgrade pg-aiguide

   Update to version 0.5.1 or later, which explicitly enables the DNS-rebinding-protection option in the MCP HTTP transport.

2. 2

   Enable host allow-list explicitly

   For any custom MCP HTTP transport deployments, explicitly configure and verify the DNS-rebinding-protection / host allow-list option rather than relying on SDK defaults.

3. 3

   Validate Host headers

   Add server-side validation to reject requests with unexpected Host header values, independent of SDK-provided protections.

4. 4

   Bind to loopback-only interfaces with authentication

   Restrict MCP server exposure to localhost and require authentication tokens for local HTTP transport connections to reduce impact if rebinding protections fail.

5. 5

   Audit other MCP servers

   Review other locally deployed MCP servers using the same or similar SDK transport factories for the same missing configuration.