{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/universal-tool-calling-protocol/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["utcp-http","@utcp/http"],"_cs_severities":["high"],"_cs_tags":["ssrf","library-vulnerability","cloud-security"],"_cs_type":"advisory","_cs_vendors":["universal-tool-calling-protocol"],"content_html":"\u003cp\u003eThe \u003ccode\u003eutcp-http\u003c/code\u003e library (and its TypeScript counterpart \u003ccode\u003e@utcp/http\u003c/code\u003e) contains a Server-Side Request Forgery (SSRF) vulnerability due to improper handling of HTTP redirects during tool invocation. The library's \u003ccode\u003eHttpCommunicationProtocol.call_tool\u003c/code\u003e method validates the initial tool URL against a security policy before execution. However, the subsequent request is performed with \u003ccode\u003eaiohttp\u003c/code\u003e's default \u003ccode\u003eallow_redirects=True\u003c/code\u003e setting without re-validating the target of any \u003ccode\u003e3xx\u003c/code\u003e redirect responses.\u003c/p\u003e\n\u003cp\u003eAn attacker controlling the registered tool endpoint can provide a redirect to internal network services, such as the IMDSv1 cloud metadata service (e.g., \u003ccode\u003e169.254.169.254\u003c/code\u003e) or internal administrative panels. Because the library does not inspect the \u003ccode\u003eLocation\u003c/code\u003e header or re-run the \u003ccode\u003eensure_secure_url\u003c/code\u003e check on follow-up requests, it inadvertently bypasses intended network segmentation controls. This vulnerability, which effectively functions as an SSRF-to-exfiltration primitive, is particularly impactful in cloud environments where it can lead to the theft of IAM credentials. The issue was addressed in version 1.1.4 by implementing per-hop revalidation of redirect targets.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker registers a tool or manual endpoint in the UTCP-enabled application using an attacker-controlled URL that passes initial security checks (e.g., any \u003ccode\u003ehttps://\u003c/code\u003e endpoint).\u003c/li\u003e\n\u003cli\u003eThe application's \u003ccode\u003ecall_tool\u003c/code\u003e method validates the provided attacker-controlled URL and confirms it satisfies the \u003ccode\u003eensure_secure_url\u003c/code\u003e policy.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eutcp-http\u003c/code\u003e library initiates a \u003ccode\u003eGET\u003c/code\u003e request to the attacker's server.\u003c/li\u003e\n\u003cli\u003eThe attacker's server responds with an HTTP \u003ccode\u003e302 Found\u003c/code\u003e status code and a \u003ccode\u003eLocation\u003c/code\u003e header pointing to an internal-only resource (e.g., \u003ccode\u003ehttp://169.254.169.254/latest/meta-data/iam/security-credentials/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe library's \u003ccode\u003eaiohttp\u003c/code\u003e client automatically follows the redirect to the target internal resource.\u003c/li\u003e\n\u003cli\u003eThe internal resource processes the request and returns sensitive data (e.g., IAM credentials) in the response body.\u003c/li\u003e\n\u003cli\u003eThe library captures the response body from the internal resource and returns it to the caller, completing the exfiltration of the data to the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for blind-to-readable SSRF, enabling unauthorized access to internal HTTP services not directly reachable from the public internet. On cloud-hosted instances configured with IMDSv1, this allows attackers to retrieve instance IAM credentials, resulting in full infrastructure or service compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003eutcp-http\u003c/code\u003e and \u003ccode\u003e@utcp/http\u003c/code\u003e to version 1.1.4 or higher immediately.\u003c/li\u003e\n\u003cli\u003eAudit all registered tool or manual endpoints to identify and remove any attacker-influenced or untrusted URL inputs.\u003c/li\u003e\n\u003cli\u003eImplement network-level restrictions (such as egress filtering or host-based firewall rules) to prevent the UTCP process from accessing cloud metadata services and internal local network segments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-25T16:01:57Z","date_published":"2026-08-25T16:01:57Z","id":"https://feed.craftedsignal.io/briefs/2026-08-utcp-ssrf/","summary":"The utcp-http library performs security validation on the initial URL but fails to re-validate the target during HTTP redirects, enabling SSRF attacks to reach internal services or cloud metadata endpoints.","title":"SSRF Vulnerability in utcp-http via Unvalidated Redirects","url":"https://feed.craftedsignal.io/briefs/2026-08-utcp-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Universal-Tool-Calling-Protocol","version":"https://jsonfeed.org/version/1.1"}