Attack Chain

1. An unauthenticated attacker sends a JSON-RPC initialize request to the meta-ads-mcp /mcp endpoint, including a non-empty Authorization: Bearer token.
2. The attacker sends a subsequent JSON-RPC tools/call request to the same /mcp endpoint, specifying upload_ad_image as the tool to execute.
3. Within the tools/call request's arguments field, the attacker includes a crafted image_url parameter pointing to an internal target (e.g., http://127.0.0.1:9009/poc.jpg, http://169.254.169.254/latest/meta-data/).
4. The meta-ads-mcp application's authorization middleware verifies only the presence of a non-empty Bearer token in the Authorization header, allowing the request to proceed to the image download logic.
5. The application passes the attacker-controlled image_url directly to the try_multiple_download_methods function in meta_ads_mcp/core/ads.py.
6. An httpx.AsyncClient instance, configured to follow_redirects=True, initiates an outbound HTTP GET request to the arbitrary URL provided in image_url without any prior scheme, host, or IP address validation.
7. The meta-ads-mcp server establishes a connection and performs the GET request against the specified internal or cloud resource.
8. The server then attempts to perform Meta API credential validation, but the Server-Side Request Forgery has already successfully occurred.

Impact

This Server-Side Request Forgery (SSRF) vulnerability allows an attacker to compel the vulnerable meta-ads-mcp server to initiate arbitrary HTTP GET requests. The primary impact is information disclosure, as an attacker can access sensitive data from internal network services, private IP ranges (RFC 1918), or cloud instance metadata endpoints (e.g., http://169.254.169.254/). This could expose highly confidential information such as IAM credentials, instance identity documents, bootstrap secrets, and internal network architecture details. Additionally, an attacker could use this vulnerability for internal network reconnaissance, mapping out accessible services, and potentially triggering state-changing actions on internal systems or causing limited denial of service by overwhelming internal targets. Organizations running meta-ads-mcp with the --transport streamable-http option in environments co-located with sensitive resources are at direct risk of compromise.

Recommendation

• Patch meta-ads-mcp to a version higher than 1.0.113 immediately, as this vulnerability has been disclosed.
• Monitor network traffic for outbound HTTP GET requests from meta-ads-mcp instances to unusual internal IP addresses (RFC 1918, localhost) or cloud metadata endpoints like 169.254.169.254, which could indicate attempted exploitation.
• Implement egress filtering on firewalls to restrict meta-ads-mcp instances from initiating connections to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) and cloud metadata addresses (e.g., 169.254.169.254).
• Review application logs for meta-ads-mcp to identify attempts to call upload_ad_image with suspicious image_url parameters referencing internal network addresses or cloud metadata endpoints as shown in the IOCs section.