58ead8e7e08bfb023

[August829]

Vendor

1Panel

Product

mcp-1panel

version

v0.1.3

Download

https://github.com/1Panel-dev/mcp-1panel

Vulnerability

Unauthorized access

Description

Any attacker who can send HTTP requests to the server's port can construct a legitimate MCP tool to call the JSON load, which the server will undoubtedly receive and execute, resulting in unauthorized operations.

Analysis

Startup Mode Selection:

In the mainfunction of main.go, the program determines the operating mode through the command-line argument -transport. When the user starts the program with -transport sse, the value of the transportvariable becomes "sse".

// main.go:95

flag.StringVar(&transport, "transport", "stdio", "Transport type (stdio or sse)")
Entering the SSE Server Startup Logic:

The program then calls runServer(transport, addr). Inside the runServerfunction, the code checks the value of the transportvariable and enters the ssebranch.

// main.go:65

func runServer(transport string, addr string) error {
    mcpServer := newMCPServer() // Creates an MCP server containing all tools
    addTools(mcpServer)

    if transport == "sse" { // <--- Condition holds true when using `-transport sse`
        port, err := utils.GetPortFromAddr(addr)
        // ...
        log.Printf("SSE server listening on :%s", port)

        // Key step: Create and start the server
        sseServer := server.NewSSEServer(mcpServer, server.WithBaseURL(addr)) // (A)
        if err := sseServer.Start(fmt.Sprintf(":%s", port)); err != nil {      // (B)
            log.Fatalf("Server error: %v", err)
        }
    } 
    // ...
    return nil
}

Creating and Starting an Unauthenticated HTTP Server:

Code Line (A) - server.NewSSEServer(...):

Here, the NewSSEServerfunction from the mcp-golibrary is called to create a new SSE server instance. The parameters passed to this function only include mcpServer(which contains all executable tools) and an optional BaseURL. This is the core of the vulnerability: at this point, the code does not pass any authentication-related parameters, such as a token, a key, or a custom middleware for request verification. The default SSE server implementation provided by the mcp-golibrary exposes a public, unauthenticated HTTP endpoint.

Code Line (B) - sseServer.Start(...):

This line of code starts the HTTP server and makes it listen for network requests on the specified port (default is 8000). Since the server instance created in step (A) does not contain any authentication logic, this listener will accept all incoming HTTP connections and directly pass the requests to the MCP request handler for processing.

Vulnerability Verification:

Start sse according to the official documentation:

http://192.168.1.77:8880/sse Unauthorized access

The tests are as follows:

POC

{
  "mcpServers": {
    "mcp-1panel": {
      "url": "http://192.168.1.77:8880/sse"
    }
  }
}