MCP Server Authentication Bypass in Presenton

Executive Summary

This vulnerability exists in Presenton versions before 0.8.8-beta, where an MCP server bundled with the software is accessible without authentication at the /mcp path when deployed on server or Docker with session authentication configured. The nginx front-end does not enforce authentication on this path, allowing a remote attacker to access MCP tools without credentials.

The MCP server automatically generates a valid internal session token for the configured user, enabling the attacker to perform authenticated actions such as generating presentations and using the operator's configured LLM API keys. The Electron desktop build is not affected because MCP is disabled there.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the /mcp endpoint is accessible without authentication on Presenton server or Docker deployments configured with session authentication (AUTH_USERNAME/AUTH_PASSWORD). Since the nginx front-end does not apply authentication to this path, an unauthenticated request to /mcp should not be allowed.

You can use network scanning or HTTP request tools to test access to the /mcp endpoint without credentials.

• Use curl to test unauthenticated access: curl -i http://<presenton-server>/mcp
• Use curl to check if authentication is enforced: curl -i -H "Authorization: Bearer invalidtoken" http://<presenton-server>/mcp
• Use tools like nmap with http-enum scripts to detect exposed endpoints.

If the /mcp endpoint responds successfully without requiring a valid bearer token or session authentication, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

An attacker can remotely access the MCP server without authentication and perform actions as if they were an authenticated user. This includes generating presentations and consuming the operator's LLM API keys, potentially leading to unauthorized use of resources and manipulation of the application.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a remote unauthenticated attacker to bypass authentication and perform actions as an authenticated user, including consuming the operator's configured LLM API keys and creating presentations within the operator's instance.

Such unauthorized access and actions could lead to unauthorized data processing or exposure, which may violate data protection requirements under regulations like GDPR or HIPAA, especially if sensitive or personal data is involved.

However, the provided information does not explicitly mention any direct impact or assessment related to compliance with GDPR, HIPAA, or other common standards and regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves updating Presenton to version 0.8.8-beta or later, where the vulnerability has been fixed by enforcing authentication on the /mcp endpoint.

The fix includes modifying the nginx configuration to apply auth_request to the /mcp path and requiring valid bearer tokens for MCP endpoints.

If updating immediately is not possible, as a temporary workaround, restrict network access to the /mcp endpoint to trusted users only, for example by firewall rules or network segmentation.

Review and update your nginx configuration to ensure the auth_request directive is applied to /mcp and /mcp/ paths.

Monitor usage of LLM API keys and presentations for unusual activity that might indicate exploitation.

Useful 0 Not Useful 0