Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mcp-contextforge-gateway | pip | < 1.0.3 | 1.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic Time-of-check Time-of-use (TOCTOU) race condition in the /admin/gateways/test endpoint, exploitable via DNS rebinding. The system's logic for testing a gateway URL was split into two disconnected steps:
Check (Validation): The mcpgateway.common.validators.validate_gateway_test_url function would resolve the hostname from the user-provided URL to an IP address and check it against a blocklist of private/internal network ranges. This was intended to prevent Server-Side Request Forgery (SSRF).
Use (Connection): The mcpgateway.admin.admin_test_gateway function, which handles the API request, would then use the original hostname (not the validated IP address) to make an HTTP request with the ResilientHttpClient.
The vulnerability lies in the gap between these two steps. The HTTP client performs its own, second DNS resolution at the time of connection. An attacker can set up a malicious DNS server with a very short Time-To-Live (TTL) that first responds with a safe, public IP address during the validation step. Immediately after validation, the attacker's DNS server changes the record to point to a private, internal IP address (e.g., 169.254.169.254 for cloud metadata services). When the HTTP client makes the actual request, it re-resolves the hostname and connects to the malicious internal IP, bypassing the SSRF protection.
The patch addresses this by implementing IP pinning. The validate_gateway_test_url function was modified to return the safe, resolved IP address. The admin_test_gateway function was updated to use this pinned IP for the outbound connection while setting the Host header and TLS SNI extension to the original hostname, thus closing the TOCTOU window.
admin_test_gatewaymcpgateway/admin.py
validate_gateway_test_urlmcpgateway/common/validators.py