DNS rebinding vulnerability in genieacs-mcp MCP Streamable HTTP transport

Vulnerability Overview Vulnerability Name: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport Vulnerability Description: exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled and headers. A malicious webpage can use DNS rebinding techniques to send browser requests to the victim's local loopback MCP listener while retaining the attacker's origin. The server accepts these requests, initializes the MCP session, lists GenieACS tools, and allows invoking tools via the configured GenieACS NBI without requiring credentials provided by the browser. Affected Versions: Software: Affected Versions: Patched Version: Severity: CVSS v4 Base Metrics: 8.8 / 10 Attack Vector: Network Attack Complexity: Low Attack Requirements: Present Privileges Required: None User Interaction: Passive Confidentiality: High Integrity: High Availability: None Impact Scope Malicious websites can control the victim's local HTTP server when it is running the documented default loopback HTTP mode. Pages can initialize MCP, list available tools, and invoke GenieACS operations through the server-configured GenieACS NBI. In real-world deployments, configuration states managed via GenieACS may be exposed or modified. Exposed tools include device reboot, firmware download task creation, TR-069 parameter changes, presets and configuration management, tag changes, connection requests, task deletion, and task retry. These operations are executed using the GenieACS backend configured in the MCP server. Remediation Fixed in v0.3.2: The HTTP transport now validates the and headers on each request, rejecting values that do not resolve to , , or . No configuration, reverse proxy, or browser deployment can allow additional values via the new and environment variables. These guards operate in combination with the existing bearer-token header check. Affected Distributions: The impact applies to the HTTP transport (Docker image / prebuilt binaries). RPM packages are unaffected because their wrapper forces , which does not expose an HTTP listener. The affected package ecosystem is set to to reflect this distinction. POC Code Start a Fake GenieACS NBI In a second terminal, run the affected MCP server ```bash git clone https://github.com/GeiserX/genieacs-mcp.git cd genieacs-mcp git checkout 4d7d3c74748efb773833aadca8e917f60e0462 GOOS=linux GOARCH=amd64 go build -o genieacs-mcp ./cmd/server ./genieacs-mcp --http://127.0.0.1:10003 \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_AUTH_TOKEN=empty \ --MCP_LISTEN_ADDR=127.0.0.1:10003 \ --MCP_

Goal Reached Thanks to every supporter — we hit 100%!

DNS rebinding vulnerability in genieacs-mcp MCP Streamable HTTP transport

More from this source