Executive Summary

This vulnerability exists in Microsoft Playwright MCP Server versions prior to 0.0.40, where the server fails to validate the Origin header on incoming connections. This flaw allows an attacker to perform a DNS rebinding attack through a victim's web browser, enabling the attacker to send unauthorized requests to a locally running MCP server and cause unintended invocation of MCP tool endpoints.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to exploit a DNS rebinding attack to send unauthorized requests to your local MCP server. This can lead to unintended execution of MCP tool endpoints, potentially compromising the security and integrity of your system or data.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your Microsoft Playwright MCP Server version is prior to 0.0.40, as those versions fail to validate the Origin header and are vulnerable to DNS rebinding attacks. To confirm exploitation attempts, monitor HTTP requests to the MCP server for suspicious or spoofed Origin and Host headers coming from browsers, especially those originating from attacker-controlled domains. A proof-of-concept involves sending a JSON-RPC "initialize" method call with an Origin header set to an attacker-controlled domain and observing if the server responds. Network monitoring tools or HTTP request logging on the MCP server can help detect such unauthorized requests. Specific commands are not provided in the resources, but you can use tools like curl or HTTP proxies to simulate requests with spoofed Origin and Host headers to test the server's response. [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Microsoft Playwright MCP Server to version 0.0.40 or later, where the vulnerability is fixed by enforcing strict Host header validation to reject unauthorized domains. Additionally, configure the MCP server's new "allowedHosts" option to specify the list of allowed hosts, either via the CLI option `--allowed-hosts` or the environment variable `PLAYWRIGHT_MCP_ALLOWED_HOSTNAMES`. This configuration ensures that the server only accepts requests from authorized hosts, effectively preventing DNS rebinding attacks. If upgrading immediately is not possible, consider restricting network access to the MCP server to trusted hosts only and monitoring for suspicious requests. [1, 3]

Useful 0 Not Useful 0