MCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)
summary
Weaponizes DNS rebinding against SSE/streaming HTTP MCP servers to pivot a browser into local/dev infrastructure, exfiltrates environment variables and escalates to remote code execution (demo pops calculator). Uses NCC Group’s Singularity of Origin DNS rebinding framework and a custom UI layered on the MCP inspector to hit real targets (Google OSS-Fuzz, Cloud Run, GKE, Docker, AWS Labs). Finds TypeScript SDK’s rebinding protection disabled by default despite MCP spec requiring Origin validation, reports multiple bugs, wins ~$2,100 in bounties.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:50Same origin policy basics
- 5:44Localhost and private network attacks
- 11:27DNS rebinding attacks
- 15:17What are MCP servers
- 17:44MCP server vulnerabilities
- 18:48Exploiting MCP servers
- 21:28Hacking Google Cloud Run
- 22:30Exploiting GKE and AWS
- 24:17Docker and Apollo MCP servers
- 25:41Fixes and browser changes
- 27:06Browser security updates
- 31:19Key takeaways and future risks
- 32:44Q&A session
related talks
24mThese Aren't the Tools You're Looking For: MCP Security Awakens
35mYour MCP Server Executes Commands - But From Whom?
13mCloud MCP Servers Under Fire
01h 06mHow hacking works
58mHacking in 2016 - How is our systems broken?
01h 04mServer-Side Browsing Considered Harmful
24mWasm't That Easy: Securing MCP With Wasm Sandboxes
33mOffensive Javascript Techniques for Red Teamers