Assessing the Attack Surface of Remote MCP Servers

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.kulkan.com/assessing-the-attack-surface-of-remote-mcp-servers-92d630a0cab0
• Blog Title: Assessing the Attack Surface of Remote MCP Servers
• Suggested Section: Generic Methodologies & Resources / Phishing Methodology / Ai Agent Abuse Local Ai Cli Tools And MCP (add a subsection: "Pentesting Remote MCP Servers: JSON-RPC enumeration, LFI/SSRF/IDOR, tool RCE, SSE→HTTP proxying")

🎯 Content Summary

Scope and spec versions
- Research date context: the post analyzes remote MCP servers using the Model Context Protocol spec version 2025-06-18.
- Transports: JSON‑RPC 2.0 over STDIN/STDOUT (local), or HTTP transports for remote: Server‑Sent Events (SSE) and streamable HTTP. SSE was deprecated in the <a href="https://modelcontextprotocol.io/specification/2025-06-18/basic/...

🔧 Technical Details

Resource URI abuse → LFI/SSRF: After resources/list, attempt resources/read with URIs outside the advertised set. If the server does not enforce an allow‑list, the server may read local files or fetch internal endpoints, enabling data theft and network pivoting.

IDOR on resource reads: In authenticated, multi‑tenant servers, directly request other tenants’ resource URIs. Missing per‑user authorization lets you exfiltrate cross‑tenant data even when OAuth authentication is in place.

Tool input → command execution: Use tools/list to map each tool’s JSON schema, then fuzz parameters that reach shells/subprocesses, templating, deserializers, or file/network sinks. If inputs interpolate into OS commands or dangerous APIs, command injection can yield RCE.

Bridge async MCP to classic proxy workflows: Run NCC’s HTTP–MCP Bridge to convert SSE to HTTP/1.1, perform the J...

🤖 Agent Actions

I reviewed the repository structure and relevant AI/MCP and phishing methodology content, then added a concise, highly-technical subsection focused on pentesting remote MCP servers to the most relevant existing page:

• Updated file: src/generic-methodologies-and-resources/phishing-methodology/ai-agent-abuse-local-ai-cli-tools-and-mcp.md

What I added

• New subsection: “Pentesting Remote MCP Servers: JSON-RPC enumeration, LFI/SSRF/IDOR, tool RCE, SSE→HTTP proxying”
• Content covers:
  • Session setup and auth model: OAuth2 vs Mcp-Session-Id
  • Transports overview: STDIO, SSE, streamable HTTP (with SSE still seen widely)
  • JSON-RPC handshake and enumeration examples for initialize, tools/list, resources/list, prompts/list
  • Exploitability checks:
    • Resources: LFI/SSRF attempts with out-of-set URIs and IDOR across tenants
    • Tools: fuzzing arguments at command/subprocess/template/deserialization/file/network sinks for RCE
    • Prompts: injection only when parameters can be attacker-controlled
  • Interception/fuzzing workflow:
    • MCP Inspector for recon
    • NCC Group HTTP–MCP Bridge for SSE→HTTP to bring traffic into Burp/Caido, including manual initialize for Mcp-Session-Id before replay/fuzzing
  • Quick test plan and impact highlights

References added at the bottom of the same file

• Assessing the Attack Surface of Remote MCP Servers (blog.kulkan.com)
• MCP Inspector (Anthropic)
• HTTP–MCP Bridge (NCC Group)
• MCP spec links (Authorization and Transports/SSE deprecation)
• Equixly MCP server security issues in the wild

Why this location

• The page already focuses on local AI CLI agent abuse and MCP, so extending it with remote MCP server pentesting guidance (enumeration, LFI/SSRF/IDOR, tool RCE, SSE→HTTP proxying workflows) fits the scope. It complements existing detection/abuse content without duplicating AI/AI-MCP-Servers, which covers different vulnerability angles (prompt injection, Cursor trust bypass).

No new files were created, and all changes were implemented via modify_file as required.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 907
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.kulkan.com/assessing-the-attack-surface-of-remote-mcp-servers-92d630a0cab0

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources / Phishing Methodology / Ai Agent Abuse Local Ai Cli Tools And MCP (add a subsection: "Pentesting Remote MCP Servers: JSON-RPC enumeration, LFI/SSRF/IDOR, tool RCE, SSE→HTTP proxying")".

Repository Maintenance:

• MD Files Formatting: 907 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0