CyberRota Analysis
AI-GeneratedThe proxy middleware in mcp-use's inspector is vulnerable due to inadequate validation of the X-Target-URL header and __mcp_target parameter, allowing attackers to direct requests to internal or private network addresses. This flaw can lead to unauthorized access to sensitive data by enabling attackers to read responses from services that should not be exposed externally. Organizations using this middleware should prioritize remediation to mitigate the risk of internal data exposure and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed.