Executive brief
sdcb chats is a web-based chat application that includes a tool discovery feature for integrating Model Context Protocol (MCP) servers. An authenticated user can exploit a server-side request forgery (SSRF) vulnerability in the MCP fetch-tools endpoint to force the backend server to make HTTP requests to arbitrary URLs, including internal services or cloud metadata endpoints. This could allow an attacker to discover and access internal infrastructure, bypass network perimeter controls, or extract sensitive metadata that should only be accessible from the server itself.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the McpController's FetchMcpTools endpoint (POST /api/mcp/fetch-tools). The endpoint accepts a user-supplied serverUrl parameter and directly constructs an HttpClientTransport to connect to it without validating against private IP ranges, localhost addresses, or any allowlist. Although the endpoint requires authentication via the [Authorize] attribute, any authenticated user can trigger outbound requests to internal network addresses, cloud metadata services (169.254.169.254), or attacker-controlled endpoints. The backend will execute these requests in its own network context, potentially exposing internal service details or allowing interaction with services that should not be externally accessible. No patch has been publicly announced as of the advisory date; the vendor did not respond to early disclosure attempts.
Affected products
- sdcb chats up to 1.12.0
Timeline
- 2026-08-31: disclosed: Vulnerability publicly disclosed; exploit now available
- other: Vendor contacted early but did not respond to disclosure