SSRF Vulnerability in get-html-skeleton MCP Tool

The get-html-skeleton tool is vulnerable to Server-Side Request Forgery (SSRF) due to improper URL validation logic within the src/tools/common/get_html_skeleton.ts file. The validation mechanism, implemented via isValidHttpUrl in src/utils/generic.ts, performs only superficial syntax checks - confirming the presence of an 'http' or 'https' scheme - without assessing the destination hostname or the resolved IP address.

This failure enables an attacker to provide URLs targeting sensitive internal infrastructure, including loopback (127.0.0.1), link-local (169.254.169.254), and private IP address ranges. Because the tool subsequently processes the fetch request and returns the resulting document content to the caller, an attacker can leverage this primitive to access protected cloud instance metadata services or other internal resources reachable from the server's network context. This vulnerability is addressed in version 0.9.12, which removes the tool entirely.

Impact

The vulnerability allows an unauthenticated attacker to bypass network boundary controls and exfiltrate sensitive data, including cloud instance credentials, environment configuration, and other internal documents that are not exposed to the public internet but are accessible from the host environment. This represents a significant risk for cloud-native deployments where metadata services are frequently used to manage identity and access rights.

Recommendation

• Immediately upgrade the relevant MCP server environment to version 0.9.12 or newer to remove the vulnerable get-html-skeleton tool.
• Audit logs for suspicious internal-range requests if the affected service is exposed to untrusted users or network segments.
• Implement egress filtering or network segmentation to restrict the server from accessing sensitive local services like the AWS, GCP, or Azure metadata endpoints (e.g., 169.254.169.254).