Penpot MCP Server WebSocket Authentication Bypass

Executive Summary

Penpot before version 2.18.0 has a vulnerability where the MCP server plugin's WebSocket bridge binds to all network interfaces without authentication in single-user mode. This allows attackers on adjacent networks to connect to the WebSocket port, impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.

Useful 0 Not Useful 0

Detection Guidance

Check if Penpot MCP is running on all network interfaces by inspecting active ports. Use commands like 'netstat -tulnp | grep 4403' or 'ss -tulnp | grep 4403' to see if the WebSocket port (4403) is bound to 0.0.0.0. Verify if Penpot versions are below 2.18.0 with 'penpot version' or by checking package.json.

Inspect network traffic for unauthenticated WebSocket connections to the MCP bridge. Monitor logs for unexpected task payloads or forged results. Use 'curl -v http://<ip>:4403' to test connectivity if the port is exposed.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers on adjacent networks could hijack plugin task execution, intercept sensitive data like code execution results or file imports, or disrupt legitimate connections. This could lead to unauthorized access to task payloads or denial-of-service by overwhelming the WebSocket server.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers on adjacent networks to intercept task payloads and return forged results, which could lead to unauthorized access to sensitive data. This may violate GDPR's data protection principles (Article 5) and HIPAA's security requirements (45 CFR Part 164) regarding access controls and integrity of protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Penpot to version 2.18.0 or later immediately. If upgrading is not possible, restrict the MCP server to localhost by setting PENPOT_MCP_SERVER_HOST=127.0.0.1 in the environment. Disable the MCP server if not in use.

Block external access to the MCP WebSocket port (4403) using firewall rules. Ensure no sensitive tasks are processed via MCP until the issue is resolved. Monitor for suspicious activity during this period.

Useful 0 Not Useful 0