fix(security): resolve DNS to close SSRF bypass + mandatory HTTP allowlist (v0.4.108)

GHSA-798p-78g2-v556: validateServerUrl only checked the hostname string, so a
name resolving to an internal IP (lvh.me -> 127.0.0.1, *.nip.io -> cloud IMDS)
bypassed the guard. A string denylist cannot close this class.

- Extract isBlockedIp(), shared by literal and resolved-IP guards
- Node/axios: SSRF-safe lookup agent resolves, validates every resolved IP and
  pins the connection (closes DNS-rebinding and redirect-to-internal); maxRedirects: 5
- sparql_query (fetch): pre-resolution check assertHostnameResolvesSafe (HTTPS-only)
- HTTP transport: refuse to start without CKAN_ALLOWED_DOMAINS unless
  CKAN_HTTP_ALLOW_ALL=true (default-deny); stdio stays open; Worker unaffected
- 11 new tests; verified end-to-end against a real HTTP deployment

Reported by: EchoSkorJjj

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aborruso

LOG.md

@@ -1,5 +1,14 @@
 # LOG
 
+## 2026-06-22
+
+### v0.4.108
+
+- Security fix (GHSA-798p-78g2-v556): close DNS-name SSRF bypass — `validateServerUrl` only checked the hostname string, so a name resolving to an internal IP (e.g. `lvh.me` → `127.0.0.1`, `*.nip.io` → cloud IMDS) bypassed the guard. Added DNS resolution + validation of every resolved IP, with connection pinning via a custom `lookup` agent (closes DNS-rebinding and redirect-to-internal) on the Node/axios path; pre-resolution check on the fetch-based `sparql_query` (HTTPS-only). Extracted `isBlockedIp` shared by literal and resolved-IP guards. `maxRedirects: 5` on CKAN requests.
+- Hardening: the network-exposed HTTP transport now refuses to start without `CKAN_ALLOWED_DOMAINS` (default-deny), unless explicitly opted out with `CKAN_HTTP_ALLOW_ALL=true` (logs a warning). stdio stays open. Cloudflare Worker unaffected (CF sandbox already blocks internal addresses).
+- 11 new tests (isBlockedIp, SSRF-safe lookup, allowlist gate, DNS-bypass on sparql). Verified end-to-end against a real HTTP deployment.
+- Reported by: EchoSkorJjj
+
 ## 2026-06-18
 
 ### v0.4.107

manifest.json

@@ -1,7 +1,7 @@
 {
   "dxt_version": "0.1",
   "name": "ckan-mcp-server",
-  "version": "0.4.107",
+  "version": "0.4.108",
   "display_name": "CKAN MCP Server",
   "description": "Explore open data portals based on CKAN (dati.gov.it, data.gov, open.canada.ca, ...)",
   "long_description": "MCP server for interacting with CKAN-based open data portals. Provides tools for advanced dataset search with Solr syntax, DataStore queries for tabular data analysis, organization and group exploration, and complete metadata access.",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aborruso/ckan-mcp-server",
-  "version": "0.4.107",
+  "version": "0.4.108",
   "mcpName": "io.github.aborruso/ckan-mcp-server",
   "description": "MCP server for interacting with CKAN open data portals",
   "main": "dist/index.js",

src/server.ts

@@ -19,7 +19,7 @@ import { registerAllPrompts } from "./prompts/index.js";
 export function createServer(): McpServer {
   return new McpServer({
     name: "ckan-mcp-server",
-    version: "0.4.107"
+    version: "0.4.108"
   });
 }
 

src/tools/sparql.ts

@@ -6,7 +6,7 @@ import { z } from "zod";
 import { ResponseFormatSchema, ResponseFormat, CHARACTER_LIMIT } from "../types.js";
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { getSparqlConfig } from "../utils/portal-config.js";
-import { validateServerUrl } from "../utils/http.js";
+import { validateServerUrl, assertHostnameResolvesSafe } from "../utils/http.js";
 
 const DEFAULT_LIMIT = 25;
 const MAX_LIMIT = 1000;
@@ -50,6 +50,8 @@ export async function querySparqlEndpoint(endpointUrl: string, query: string): P
   if (url.protocol !== "https:") {
     throw new Error("Only HTTPS endpoints are allowed");
   }
+  // SSRF: block hostnames that resolve to private/internal addresses (DNS-name bypass)
+  await assertHostnameResolvesSafe(url.hostname);
 
   const sparqlConfig = getSparqlConfig(endpointUrl);
   const method = sparqlConfig?.method ?? "POST";

src/transport/http.ts

@@ -5,8 +5,13 @@
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createServer, registerAll } from "../server.js";
+import { assertHttpAllowlistConfigured } from "../utils/http.js";
 
 export async function runHTTP() {
+  // Network-exposed transport: require a domain allowlist (fail-fast) unless
+  // explicitly opted out via CKAN_HTTP_ALLOW_ALL=true.
+  assertHttpAllowlistConfigured();
+
   const app = express();
   app.use(express.json());
 

src/utils/http.ts

@@ -238,9 +238,46 @@ async function decodePossiblyCompressed(
   }
 }
 
+/**
+ * Returns true if an IP address (IPv4 or IPv6 string) is in a private/internal/special range.
+ * Shared by the synchronous literal guard (`validateServerUrl`) and the DNS-resolution
+ * guard (`createSsrfSafeLookup` / `assertHostnameResolvesSafe`), so a hostname that
+ * *resolves* to an internal address is blocked, not just an internal IP literal.
+ */
+export function isBlockedIp(ip: string): boolean {
+  const v = ip.toLowerCase().trim();
+
+  // IPv6 (any address containing a colon)
+  if (v.includes(':')) {
+    if (v === '::1' || v === '::') return true;     // loopback / unspecified
+    if (v.startsWith('fc') || v.startsWith('fd')) return true; // fc00::/7 unique local
+    if (v.startsWith('fe80')) return true;          // fe80::/10 link-local
+    if (v.startsWith('::ffff:')) return true;       // IPv4-mapped IPv6
+    return false;
+  }
+
+  // IPv4 dotted-decimal
+  const m = v.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  if (!m) return false;
+  const o1 = Number(m[1]);
+  const o2 = Number(m[2]);
+  return (
+    o1 === 0 ||                              // 0.0.0.0/8
+    o1 === 10 ||                             // 10.0.0.0/8 private
+    o1 === 127 ||                            // 127.0.0.0/8 loopback
+    (o1 === 100 && o2 >= 64 && o2 <= 127) || // 100.64.0.0/10 shared
+    (o1 === 169 && o2 === 254) ||            // 169.254.0.0/16 link-local / cloud metadata
+    (o1 === 172 && o2 >= 16 && o2 <= 31) ||  // 172.16.0.0/12 private
+    (o1 === 192 && o2 === 168) ||            // 192.168.0.0/16 private
+    o1 === 255                               // broadcast
+  );
+}
+
 /**
  * Validate that a server URL is safe to request (SSRF prevention).
- * Blocks non-HTTP/S protocols and private/internal IP ranges.
+ * Blocks non-HTTP/S protocols and private/internal IP *literals*.
+ * Hostnames that resolve to internal IPs are blocked later, at connection time,
+ * by the DNS-resolution guards (see `createSsrfSafeLookup` / `assertHostnameResolvesSafe`).
  */
 export function validateServerUrl(serverUrl: string): void {
   let parsed: URL;
@@ -265,38 +302,14 @@ export function validateServerUrl(serverUrl: string): void {
     throw new Error(`Access to "${hostname}" is not allowed.`);
   }
 
-  // Block IPv4 private/special ranges
-  const ipv4 = hostname.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
-  if (ipv4) {
-    const [o1, o2] = ipv4.slice(1).map(Number);
-    const blocked =
-      o1 === 0 ||                              // 0.0.0.0/8
-      o1 === 10 ||                             // 10.0.0.0/8 private
-      o1 === 127 ||                            // 127.0.0.0/8 loopback
-      (o1 === 100 && o2 >= 64 && o2 <= 127) || // 100.64.0.0/10 shared
-      (o1 === 169 && o2 === 254) ||            // 169.254.0.0/16 link-local / AWS metadata
-      (o1 === 172 && o2 >= 16 && o2 <= 31) ||  // 172.16.0.0/12 private
-      (o1 === 192 && o2 === 168) ||            // 192.168.0.0/16 private
-      o1 === 255;                              // broadcast
-    if (blocked) {
-      throw new Error(`Access to private/internal IP addresses is not allowed.`);
-    }
+  // Block IPv4 private/special literals
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(hostname) && isBlockedIp(hostname)) {
+    throw new Error(`Access to private/internal IP addresses is not allowed.`);
   }
 
-  // Block IPv6 private/loopback
-  if (hostname.startsWith('[')) {
-    const ipv6 = hostname.slice(1, -1);
-    const lower = ipv6.toLowerCase();
-    const blockedIpv6 =
-      lower === '::1' ||           // loopback
-      lower === '::' ||            // unspecified
-      lower.startsWith('fc') ||    // fc00::/7 unique local
-      lower.startsWith('fd') ||    // fd00::/8 unique local
-      lower.startsWith('fe80') ||  // fe80::/10 link-local
-      lower.startsWith('::ffff:'); // IPv4-mapped
-    if (blockedIpv6) {
-      throw new Error(`Access to private/internal IPv6 addresses is not allowed.`);
-    }
+  // Block IPv6 private/loopback literals (URL hostname keeps the brackets)
+  if (hostname.startsWith('[') && isBlockedIp(hostname.slice(1, -1))) {
+    throw new Error(`Access to private/internal IPv6 addresses is not allowed.`);
   }
 
   // Optional domain allowlist: CKAN_ALLOWED_DOMAINS=domain1.com,domain2.org
@@ -307,6 +320,141 @@ export function validateServerUrl(serverUrl: string): void {
   }
 }
 
+/**
+ * Refuse to run the network-exposed HTTP transport without a domain allowlist.
+ * `CKAN_ALLOWED_DOMAINS` (default-deny) is mandatory for HTTP; set
+ * `CKAN_HTTP_ALLOW_ALL=true` to explicitly opt out (logs a warning).
+ * stdio is unaffected — it stays open so any portal can be queried locally.
+ */
+export function assertHttpAllowlistConfigured(): void {
+  const raw = typeof process !== 'undefined' ? (process.env.CKAN_ALLOWED_DOMAINS ?? '') : '';
+  const domains = raw.split(',').map(s => s.trim()).filter(Boolean);
+  if (domains.length > 0) return;
+
+  if (typeof process !== 'undefined' && process.env.CKAN_HTTP_ALLOW_ALL === 'true') {
+    console.error(
+      '[SECURITY WARNING] HTTP transport is running WITHOUT a domain allowlist ' +
+      '(CKAN_HTTP_ALLOW_ALL=true). Any client can drive requests to arbitrary hosts. ' +
+      'Set CKAN_ALLOWED_DOMAINS to restrict which CKAN hosts can be queried.'
+    );
+    return;
+  }
+
+  throw new Error(
+    'Refusing to start HTTP transport without a domain allowlist.\n' +
+    'Set CKAN_ALLOWED_DOMAINS="portal1.org,portal2.gov" to restrict which hosts can be queried,\n' +
+    'or set CKAN_HTTP_ALLOW_ALL=true to explicitly run without restriction (NOT recommended when network-exposed).'
+  );
+}
+
+type ResolvedAddress = { address: string; family?: number };
+type DnsLookupModule = {
+  lookup: (
+    hostname: string,
+    options: { all: true; family?: number },
+    callback: (err: NodeJS.ErrnoException | null, addresses: ResolvedAddress[]) => void
+  ) => void;
+};
+
+/**
+ * Build a Node `lookup` function (for http/https Agents) that resolves the hostname,
+ * rejects if ANY resolved address is private/internal, and pins the connection to the
+ * validated address — closing the DNS-name SSRF bypass and DNS-rebinding (the IP the
+ * socket connects to is exactly the one we validated, no second resolution).
+ * Exported with an injectable dns module so it can be unit-tested without real DNS.
+ */
+export function createSsrfSafeLookup(dnsModule: DnsLookupModule) {
+  return function ssrfSafeLookup(hostname: string, options: any, callback: any): void {
+    if (typeof options === 'function') {
+      callback = options;
+      options = {};
+    }
+    const family = options && typeof options === 'object' ? options.family : undefined;
+    dnsModule.lookup(hostname, { all: true, family: family || 0 }, (err, addresses) => {
+      if (err) {
+        callback(err);
+        return;
+      }
+      const list = Array.isArray(addresses) ? addresses : [addresses as ResolvedAddress];
+      for (const a of list) {
+        if (isBlockedIp(a.address)) {
+          callback(new Error(
+            `Access to private/internal IP addresses is not allowed ` +
+            `("${hostname}" resolves to ${a.address}).`
+          ));
+          return;
+        }
+      }
+      if (options && options.all) {
+        callback(null, list);
+        return;
+      }
+      callback(null, list[0].address, list[0].family);
+    });
+  };
+}
+
+let _safeAgents: Promise<{ httpAgent: unknown; httpsAgent: unknown } | null> | null = null;
+
+/** Lazily build SSRF-safe http/https Agents (Node only). Returns null off Node/on failure. */
+function getSafeAgents(): Promise<{ httpAgent: unknown; httpsAgent: unknown } | null> {
+  if (!_safeAgents) {
+    _safeAgents = (async () => {
+      try {
+        // String-concatenated specifiers keep esbuild from bundling node builtins
+        // into the Cloudflare Workers build (mirrors loadZlib above).
+        const dnsMod = (await import("node:" + "dns")) as unknown as DnsLookupModule;
+        const httpMod = (await import("node:" + "http")) as any;
+        const httpsMod = (await import("node:" + "https")) as any;
+        const lookup = createSsrfSafeLookup(dnsMod);
+        return {
+          httpAgent: new httpMod.Agent({ lookup }),
+          httpsAgent: new httpsMod.Agent({ lookup }),
+        };
+      } catch {
+        return null;
+      }
+    })();
+  }
+  return _safeAgents;
+}
+
+type DnsResolver = (hostname: string) => Promise<ResolvedAddress[]>;
+let _dnsResolver: DnsResolver | null = null;
+
+/** Test seam: override the DNS resolver used by `assertHostnameResolvesSafe`. */
+export function __setDnsResolverForTests(fn: DnsResolver | null): void {
+  _dnsResolver = fn;
+}
+
+/**
+ * Resolve a hostname and throw if it maps to a private/internal IP.
+ * Used by the fetch-based paths (e.g. sparql_query) that cannot attach a custom
+ * lookup agent. No-op when DNS is unavailable (Cloudflare Workers — CF sandbox
+ * already blocks internal addresses) or when resolution fails (request fails naturally).
+ */
+export async function assertHostnameResolvesSafe(hostname: string): Promise<void> {
+  let addresses: ResolvedAddress[];
+  try {
+    if (_dnsResolver) {
+      addresses = await _dnsResolver(hostname);
+    } else {
+      const dnsMod = (await import("node:" + "dns")) as any;
+      addresses = await dnsMod.promises.lookup(hostname, { all: true });
+    }
+  } catch {
+    return; // DNS unavailable (Workers) or resolution failed → let the request proceed/fail naturally
+  }
+  for (const a of addresses) {
+    if (isBlockedIp(a.address)) {
+      throw new Error(
+        `Access to private/internal IP addresses is not allowed ` +
+        `("${hostname}" resolves to ${a.address}).`
+      );
+    }
+  }
+}
+
 function auditLog(serverUrl: string, action: string, params: Record<string, any>, cacheHit: boolean): void {
   if (typeof process === 'undefined' || !(process as { versions?: { node?: string } }).versions?.node) return;
   const entry: Record<string, unknown> = {
@@ -384,10 +532,15 @@ export async function makeCkanRequest<T>(
     let decodedData: unknown;
 
     if (isNode) {
+      const safeAgents = await getSafeAgents();
       const response = await axios.get(url, {
         params,
         timeout: 30000,
         responseType: "arraybuffer",
+        maxRedirects: 5,
+        ...(safeAgents
+          ? { httpAgent: safeAgents.httpAgent, httpsAgent: safeAgents.httpsAgent }
+          : {}),
         headers: {
           Accept: 'application/json, text/plain, */*',
           'Accept-Language': 'en-US,en;q=0.9,it;q=0.8',

src/worker.ts

@@ -220,7 +220,7 @@ export default {
     if (request.method === 'GET' && url.pathname === '/health') {
       return new Response(JSON.stringify({
         status: 'ok',
-        version: '0.4.107',
+        version: '0.4.108',
         tools: 20,
         resources: 7,
         prompts: 6,

tests/integration/sparql.test.ts

@@ -1,10 +1,17 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterAll } from 'vitest';
 import { formatSparqlMarkdown, formatSparqlJson, querySparqlEndpoint, validateSelectQuery, injectLimit } from '../../src/tools/sparql';
+import { __setDnsResolverForTests } from '../../src/utils/http';
 
 describe('sparql_query', () => {
   beforeEach(() => {
     vi.stubGlobal('fetch', vi.fn());
     vi.clearAllMocks();
+    // Default: resolve every hostname to a public IP so tests stay offline.
+    __setDnsResolverForTests(async () => [{ address: '93.184.216.34', family: 4 }]);
+  });
+
+  afterAll(() => {
+    __setDnsResolverForTests(null);
   });
 
   const mockFetch = (payload: unknown, ok = true, status = 200) => {
@@ -67,6 +74,13 @@ describe('sparql_query', () => {
       ).rejects.toThrow('private/internal');
     });
 
+    it('rejects hostnames that RESOLVE to an internal IP (DNS-name bypass)', async () => {
+      __setDnsResolverForTests(async () => [{ address: '127.0.0.1', family: 4 }]);
+      await expect(
+        querySparqlEndpoint('https://internal.lvh.me/sparql', 'SELECT * WHERE { }')
+      ).rejects.toThrow('private/internal');
+    });
+
     it('throws on HTTP error response', async () => {
       mockFetch({ error: 'bad query' }, false, 400);