SSRF in mixelpixx google-search-mcp 0.1.0 via extractContent

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: mixelpixx google-search-mcp 0.1.0 Server-Side Request Forgery (SSRF) Pull Request ID: #781778 Description: The mixelpixx google-search-mcp 0.1.0 component contains a Server-Side Request Forgery (SSRF) vulnerability. This component serves as an MCP (Model Context Protocol) tool for the mixelpixx application, accepting user-controlled URL parameters and forwarding them to outbound HTTP request functions for validation. Specifically, in , the function invokes axios's method, which can be exploited via the MCP protocol interface. Attackers can leverage this to redirect requests to attacker-controlled URLs, enabling reconnaissance of internal server network resources. This may lead to discovery of internal network assets, access to metadata services of private instances (e.g., AWS v1.x.x.x), and interaction with internal systems. The vulnerability exists because user-provided input is trusted as the target of outbound HTTP requests, without implementing proper safeguards such as scheme validation, host allowlisting, or blocking of loopback and private network addresses. Affected Scope Affected Component: mixelpixx google-search-mcp 0.1.0 Affected Service: mixelpixx application (via MCP protocol interface) Specific File: ( function) Remediation No specific fix code or patch is provided on the page, but the description implies the following mitigation directions: Scheme validation Host allowlisting Blocking of loopback and private network addresses POC/Exploitation Code No specific POC code or exploitation snippet is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

SSRF in mixelpixx google-search-mcp 0.1.0 via extractContent