Credential Exfiltration and SSRF in utcp-http via OAuth2 tokenUrl

The utcp-http library (versions <= 1.1.3) contains a critical trust boundary bypass vulnerability that allows for unauthorized credential exfiltration and Server-Side Request Forgery (SSRF). The library automatically extracts OAuth2 configuration, specifically the tokenUrl field, from remote OpenAPI specifications during the conversion process without performing any security validation. While the library enforces secure URL checks for discovery and tool invocation, these safeguards are omitted when performing OAuth2 token requests. An attacker can craft a malicious OpenAPI specification containing an arbitrary tokenUrl, which, when registered and triggered by a victim, causes the library to perform a POST request containing the victim's OAuth2 client_id and client_secret to an attacker-controlled endpoint. This vulnerability poses a significant risk to applications that register third-party OpenAPI specifications while utilizing OAuth2 authentication.

Attack Chain

1. The attacker hosts a malicious OpenAPI specification on an accessible server, defining an OAuth2 security scheme with a custom, attacker-controlled tokenUrl.
2. The victim registers the attacker's OpenAPI spec URL within their application using utcp-http.
3. The OpenApiConverter component fetches and parses the specification, extracting the malicious tokenUrl into an OAuth2Auth object without validation.
4. The victim invokes an OAuth2-protected tool via the utcp-http client.
5. The HttpCommunicationProtocol triggers the _handle_oauth2 method to retrieve an access token prior to the actual tool request.
6. The _handle_oauth2 method performs an asyncio POST request using the verbatim, unvalidated tokenUrl extracted from the specification.
7. The victim's application sends client_id and client_secret credentials to the attacker's server, or performs an SSRF request to internal infrastructure.
8. The attacker captures the exfiltrated credentials to gain unauthorized access to protected resources on behalf of the victim.

Impact

Successful exploitation leads to immediate credential theft of OAuth2 client_id and client_secret pairs, providing attackers with full impersonation capabilities for the victim's identity. Furthermore, the lack of URL validation permits SSRF attacks against internal network resources, such as cloud metadata services (e.g., 169.254.169.254) or private internal APIs that are otherwise inaccessible from the public internet. Organizations that rely on utcp-http to integrate third-party or untrusted OpenAPI specifications are at high risk.

Recommendation

Prioritized, concrete actions for detection and remediation:

• Upgrade utcp-http to a patched version once available or implement the suggested remediation patch manually.
• Implement the ensure_secure_url() check within openapi_converter.py and http_communication_protocol.py to validate tokenUrl parameters before use.
• Audit all registered OpenAPI specifications to ensure tokenUrl domains align with known, trusted identity providers.
• Monitor web application logs for outgoing POST requests from the utcp-http client to unusual or external IP addresses in the tokenUrl field.
• Restrict the network environment of the service using utcp-http to prevent egress to unauthorized endpoints, reducing the impact of potential SSRF.