adloop MCP Server SSRF via Unvalidated final_url Parameter

[Potential Vulnerability] adloop fetches a caller-controlled URL with no scheme/host validation — SSRF + local-file access via final_url #41 Vulnerability Overview adloop is an MCP server providing read-only access to Google Ads + GAA for AI assistants. Several of its "draft" tools accept a (the ad destination URL or a "starlink" variable) and, for convenience, validate that the URL is reachable before creating the ad. The validation function passes the caller-provided URL directly to without a URL scheme allowlist or host/IP filtering. Since the URL originates directly from MCP tool parameters (controllable by the attacker via prompt-injected LLMs, malicious tool calls, or any client with access to the server), this constitutes a Server-Side Request Forgery (SSRF) vulnerability. or → The server makes requests to internal/cloud metadata/loopback endpoints that are otherwise inaccessible. → The scheme is not rejected; opens the local file, and differing error responses create a local file existence oracle. The check occurs during the preview/validation step, prior to any authenticated Google Ads API calls, meaning valid Google credentials are not required to trigger the issue—as long as the MCP server is running. The response body is not returned to the caller, making this a Blind SSRF + Existence Oracle (medium severity, not high)—but still sufficient for internal port scanning, hitting cloud metadata/internal management endpoints, and probing local files. Scope Repository: KLOsk/adloop Package: adloop (PyPI) Tested Version: 0.9.0 Affected Code: in Source: MCP tools and other starlink tools pass URLs to CWE / Classification CWE-918: Server-Side Request Forgery (SSRF) CWE-20: Improper Input Validation (no URL scheme/host allowlist) CWE-510: Externally Controlled Reference to a Resource (file:// scheme) Impact: Blind SSRF to internal/loopback/local/cloud metadata HTTP endpoints from the server's network location; local file existence oracle via response content differences. Remediation Validate the scheme and resolve the target host before calling : Then, in , skip the check for any URL and return an error. It is also advisable to disable (or apply the same check to) the HTTP 403 GET fallback, and consider not following redirects to non-public hosts. POC Code Execution Results The internal listener received the request (Blind SSRF). For , opens the target (if supported). The errors result from the code crashing on : the response lacks an HTTP code after the file is opened; a missing file produces a different exception—creating an available existence oracle. Expected Behavior The URL reachability check should only permit external HTTP/HTTPS requests to public hosts. , , loopback, link-local, private, and cloud metadata targets must be rejected before any network/file access is attempted.

Goal Reached Thanks to every supporter — we hit 100%!

adloop MCP Server SSRF via Unvalidated final_url Parameter

More from this source