SSRF - OpenAPI $ref Loopback/Metadata Bypass (FrontMCP / mcp-from-openapi)
Some MCP tooling (FrontMCP / mcp-from-openapi) fetches external OpenAPI documents and checks the target hostname against a denylist before dereferencing $ref links. That check only looks at the literal text of the hostname, so an attacker can encode a forbidden address in a form the filter doesn't recognize and reach internal services or cloud metadata endpoints anyway.
How the attack works
An attacker supplies or influences an OpenAPI document containing a $ref that points to a forbidden target — loopback, link-local, or cloud metadata addresses like 169.254.169.254 or 100.100.100.200. Instead of writing the address plainly, they encode it as decimal, octal, or hex IPv4, as IPv4-mapped IPv6, as bracketed ::1, or via wildcard-DNS services (nip.io, sslip.io, localtest.me, vcap.me, lvh.me) that resolve to a loopback or metadata IP. The denylist only pattern-matches the hostname string and never resolves it or re-checks where a redirect leads, so the encoded reference slips through. The server then fetches the disguised target, letting the attacker retrieve cloud credentials, internal admin endpoints, or other resources that should be unreachable from outside.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f3a9c2d4-7b1e-4c8a-9d3f-2e6b8a1c4f70
- Severity
- High
Why it matters
Successful exploitation can leak cloud instance metadata (including temporary credentials), reach internal-only services, or access local admin endpoints that were meant to be blocked — a classic SSRF outcome inside an agent/MCP pipeline.
What you can do
- →Validate hostnames after DNS resolution, not just as strings, and re-validate on every redirect hop.
- →Block outbound requests to loopback, link-local, and known cloud metadata IPs at the network layer, not just in application code.
- →Disable or restrict resolution of wildcard-DNS test domains (nip.io, sslip.io, localtest.me, vcap.me, lvh.me) in production environments.
- →Treat any externally supplied OpenAPI document as untrusted input and sandbox or restrict the network egress of the service that dereferences its $ref links.
Known benign look-alikes
- An agent or MCP server that legitimately calls its own local sidecar or health-check endpoint on 127.0.0.1/localhost as part of normal operation (this rule will report, not block, so operation is not disrupted)
- Internal QA/CI tooling that intentionally references 127.0.0.1 or 0.0.0.0 in OpenAPI test fixtures used for local schema validation
- Development environments that use nip.io/xip.io/sslip.io wildcard DNS to point at a loopback address on purpose for local integration testing
- Documentation or example OpenAPI specs that use 127.0.0.1 in a $ref purely as illustrative sample text rather than a live dereference target