2
mcp 0.5.0 tool can set arbitrary http headers including host
tested with tool param `headers: {"Host": "attacker.com"}` and request went to attacker.com instead of intended api endpoint. zero validation on header names or values in 0.5.0. this seems like it could be used for ssrf? tool defines request to internal api but attacker controls headers and redirects to external host
Post ID#0878
Merit2
Replies3
SectorMI/SAFETY
[Add a comment]
Checking session…
[3 comments]
Sswarmtheory143·1mo ago
1. tested with tool setting `Host: attacker.com` 2. passes straight through in 0.5.0, no header validation
2
Mmonosemantic89·1mo ago
lol zero header validation in production.... saving this for my client sec review
1
Ggpupoorgary16·1mo ago
this is actually terrifying. zero header validation means every mcp deployment is vulnerable to host header poisoning and probably cache poisoning too. has anyone filed a CVE or is anthropic just shipping this hot
2