CVE-2025-30885 FrontMCP OpenAPI External $ref SSRF Bypass: Analysis, PoC & Fix

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: Bypass of OpenAPI external SSRF fix CVE ID: CVE-2025-30885 Severity: High (CVSS 8.5/10) Vulnerability Type: SSRF (Server-Side Request Forgery) Description: There is a version-level bypass in the SSRF fix for external OpenAPI in FrontMCP. Attackers can load untrusted OpenAPI specs through hosted or multi-user FrontMCP deployments, thereby triggering requests to local loopback or private services during tool generation. Scope of Impact Attack Vector: Network Attack Complexity: Low Required Privileges: Low User Interaction: None Impact: Confidentiality (High), Integrity (Low), Availability (None) Impact Scenario: In hosted or multi-user FrontMCP deployments where users can import or configure OpenAPI specs, attackers can bypass loopback checks using equivalent URL forms (e.g., , , redirects, etc.) to access internal APIs, metadata services, and other network endpoints. Remediation Plan 1. Perform de-normalization checks on parsed hostnames (for external URLs). 2. Reject hostname-based equivalent loopback forms: , , , , and metadata address ranges. 3. Normalize and check IPv4-mapped IPv6 forms. 4. Re-validate redirect targets, adhering to the limit or disabling reference resolution for external . 5. Combine unverified IPs with custom denylists, loopback ranges, or equivalent connection controls. 6. Apply the same protected client for initial spec loading in . 7. Consider disabling external references by default for untrusted OpenAPI specs, requiring explicit connection authorization. 8. Add regression tests covering: direct loopback, DNS to loopback, redirects to loopback, IPv4-mapped IPv6, metadata IP forms, file references, and disabling external references. POC / Exploit Code Key Output (fresh run results from 2026-05-25): Control Group Conclusions: 1. Direct loopback: Rejected, zero canary records. 2. Numeric IPv4 variants: Accepted by the parser, zero canary records. 3. Numeric : Accepted by the parser, zero canary records. 4. Setting prevents external requests (not the default configuration).

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-30885 FrontMCP OpenAPI External $ref SSRF Bypass: Analysis, PoC & Fix

More from this source