dify - 💡(How to fix) Fix Security: SSRF via MCP Tool Provider server_url (authenticated users can reach internal services) [1 participants]

Security Issue Report

Severity: High (CVSS 3.1: 7.7) Component: api/services/tools/mcp_tools_manage_service.py Affected endpoint: POST /console/api/workspaces/current/tool-provider/mcp

Summary

The MCP tool provider creation endpoint accepts an arbitrary server_url parameter from any authenticated user (no admin role required). The URL validation in _is_valid_url() only checks that the scheme is http/https and a netloc is present — it does not check whether the target IP is a private or internal address. After this format-only validation, Dify immediately makes an HTTP connection to the supplied URL via MCPToolManageService.reconnect_with_url().

When the SSRF proxy (SSRF_PROXY_HTTP_URL / SSRF_PROXY_HTTPS_URL) is not configured — which is the default in api/.env.example — the connection goes directly to the target, enabling SSRF to internal services including cloud instance metadata (169.254.169.254).

This is a distinct vector from CVE-2025-56520 (RemoteFileUploadApi) and CVE-2026-6618 (ApiBasedToolSchemaParser).

Affected Code

• api/services/tools/mcp_tools_manage_service.py:710 — _is_valid_url(): format-only validation
• api/controllers/console/workspace/tool_providers.py:956 — ToolProviderMCPApi.post(): immediate network call
• api/core/mcp/utils.py:18 — create_ssrf_proxy_mcp_http_client(): unprotected fallback
• api/.env.example:477-478 — proxy vars empty by default

Suggested Fix

Add private IP validation in _is_valid_url() before the network call (resolve hostname, reject RFC1918 / link-local / loopback ranges). Or ensure SSRF_PROXY_* configuration is required and validated at startup.

Contact

I have a detailed technical write-up and PoC available. Please let me know the preferred private channel for sharing the full details.

Reported by: security researcher (responsible disclosure)