Medium

Neo4j Cypher MCP DNS Rebinding Tool Invocation

This detects browser-based requests that abuse DNS rebinding to call a Neo4j Cypher MCP tool (read, write, or schema access) running on a victim's own machine. The request looks like it comes from a public web page but resolves to a local or internal address, tricking the locally bound MCP server into executing commands it should only accept from the local machine.

How the attack works

A local Neo4j MCP server binds to a port like 7474 or 7687 and trusts requests without checking origin. An attacker gets a victim's browser to load a page under a domain they control, then uses DNS rebinding so the same hostname later resolves to 127.0.0.1 or an internal IP. The browser, still treating the hostname as the original origin, sends a JSON-RPC 'tools/call' request invoking read_neo4j_cypher, write_neo4j_cypher, or get_neo4j_schema against the local server. Because the request carries a DNS name embedding a loopback/private address, or a public-looking hostname with an explicit local-service port, it stands out from normal local MCP traffic, which always uses localhost or 127.0.0.1 directly.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
7b3f9c2a-5d41-4e8b-9a6f-1c0d84e37f52
Severity
Medium

Why it matters

An attacker can read or write data in a Neo4j database through its Cypher MCP tool, and inspect its schema, without ever having direct network access to the victim's machine — using only a webpage the victim's browser visits.

What you can do

  • →Bind local MCP servers (Neo4j Cypher MCP included) to 127.0.0.1 only, and reject requests with a Host header that isn't localhost or 127.0.0.1.
  • →Enforce origin/Referer checks on the MCP server so browser-originated cross-origin calls are rejected outright.
  • →Require authentication tokens for tools/call requests instead of relying on network location as a trust boundary.
  • →If you intentionally expose the MCP server on an internal FQDN or non-standard port, document and monitor that exposure so it can be distinguished from genuine rebinding attempts.

Known benign look-alikes

  • Developer or CI use of a wildcard-DNS loopback service (nip.io, sslip.io, lvh.me, localtest.me) as a convenience hostname for a locally bound Neo4j MCP server — same wire shape as a rebind, distinguishable only by intent.
  • A self-hosted Neo4j Cypher MCP server published on an internal FQDN with an explicit non-standard port over plain HTTP (e.g. http://neo4j-mcp.corp.example:8000/mcp); branch (b) will match. No host is excluded, because trust lists may not be widened here.
  • mDNS/Bonjour style names such as neo4j.local:7474 reached by an agent on the LAN.
  • Security research, rebinding-tool regression tests, or red-team exercises replaying the exact rebinding hostname shape against a lab MCP instance.
  • Documentation or tutorial payloads that embed a full tools/call JSON example; these are largely suppressed by filter_markdown_doc and filter_template.

References