{"uuid": "2b5945e7-c6bb-475e-afca-ac3bc811166f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-jgh3-fggc-mcpm", "type": "seen", "source": "https://gist.github.com/alon710/f13f4c40382dd44335baac4abb0ac5c3", "content": "# GHSA-JGH3-FGGC-MCPM: GHSA-jgh3-fggc-mcpm: Non-Blind Server-Side Request Forgery (SSRF) in Obot Platform\n\n> **CVSS Score:** 7.6\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/GHSA-JGH3-FGGC-MCPM\n\n## Summary\nAn authenticated Server-Side Request Forgery (SSRF) vulnerability in the Obot Platform allows administrative or power users to bypass IP verification and scan or query internal resources, private networks, and cloud instance metadata services (IMDS). Because response bodies and error details are reflected back to the client interface, this constitutes a non-blind SSRF.\n\n## TL;DR\nA non-blind SSRF in Obot Platform < 0.23.0 allows privileged users to query local network assets and extract cloud metadata credentials (such as AWS IAM tokens) via remote MCP registration.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918, CWE-1188\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.6 (High)\n- **Impact**: Confidentiality High, Integrity Low, Availability None\n- **Exploit Status**: Proof-of-Concept / Conceptual\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Obot Platform\n- **Obot Platform**: < 0.23.0 (Fixed in: `0.23.0`)\n\n## Mitigation\n\n- Upgrade Obot Platform to version 0.23.0 or later to enable default IP blocklists.\n- Implement dial-time socket verification to prevent DNS Rebinding.\n- Deploy Kubernetes NetworkPolicies to block egress access to 169.254.169.254 and RFC 1918 networks.\n- Enable IMDSv2 with a hop limit of 1 on cloud instances to mitigate SSRF attempts against metadata endpoints.\n\n**Remediation Steps:**\n1. Assess current deployment versions to identify if any run on <= 0.22.1 with authentication active.\n2. Modify deployment configuration or Helm chart values to reference tag v0.23.0 or higher.\n3. Verify that variables OBOT_SERVER_DISALLOW_LOCALHOST_MCP, OBOT_SERVER_DISALLOW_PRIVATE_IP_MCP, and OBOT_SERVER_DISALLOW_LINK_LOCAL_MCP are set to true.\n4. Check application logs for resolution-blocking errors to identify potential scanning attempts.\n\n## References\n\n- [GitHub Security Advisory GHSA-jgh3-fggc-mcpm](https://github.com/advisories/GHSA-jgh3-fggc-mcpm)\n- [Obot Platform Security Advisory](https://github.com/obot-platform/obot/security/advisories/GHSA-jgh3-fggc-mcpm)\n- [Obot Platform v0.23.0 Release Notes](https://github.com/obot-platform/obot/releases/tag/v0.23.0)\n- [Pull Request #6935: Enforce Outbound Host Verification](https://github.com/obot-platform/obot/pull/6935)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-JGH3-FGGC-MCPM) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-18T18:32:04.396592Z"}