Novice-22

Use of an uninitialized resource in ASP.NET Core allows an unauthorized attacker to disclose information over a network. Specifically, a reused `ResponseBufferingStream` can retain pooled tail memory, which may expose response-body data from a different request through HTTP logging.

The `serve` command uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication. This allows any network client capable of reaching the `/mcp` endpoint to invoke the exposed agent tool. If the server is started with the `--shell` flag, the agent can utilize the local execute tool implemented by `tools/local shell executor.py`, enabling an unauthenticated remote client to execute operating-system commands with the privileges of the server user. In the absence of the `--shell` flag, clients can still utilize the operator's model and configured Model Context Protocol (MCP) tools. The defaults are established in `cli/commands/serve.py` and `mcp/server/agent server.py`, and the non-interactive server permission prompt does not block this access.

When the opt-in HTTP server is enabled via `MCP TRANSPORT=http`, the server logs that `X-API-Key` authentication is active after reading the `MCP API KEY` variable, but it fails to validate the `X-API-Key` header on incoming requests. This allows unauthenticated clients to access the `/mcp` endpoint. Because the default bind address is `0.0.0.0`, any client reaching the port can invoke all PDF tools and read any PDF file accessible to the server process on the host. Additionally, URL-based sources allow limited server-side request forgery (SSRF), a vulnerability where an attacker induces the server to make requests to an unintended location, although private and loopback destinations are blocked unless `--allow-private-ips` is enabled. The default `stdio` transport is not affected.

An authenticated non-admin user can register a server pointing to an arbitrary URL, causing the hub to issue server-side requests without egress filtering. This lack of filtering allows requests to loopback, RFC1918, and link-local 169.254.0.0/16 addresses. When using the OpenAPI proxy path, the response body is returned to the caller, resulting in a reflected Server-Side Request Forgery (SSRF), a condition where an attacker induces the server to make requests to an unintended location. When using the SSE/streamable-http transport, the request is sent blind.

The software contains an arbitrary file write flaw where the `browser download` function writes a fetched response body to a path created by `join(save dir, filename)` without validating the `save dir` variable. Additionally, the `browser save state` and `browser load state` functions honor a caller-controlled `path` without validation. A malicious MCP client or an autonomous agent influenced by indirect prompt injection can specify an arbitrary `save dir` or state `path` and a URL to write attacker-controlled content to any location the process can access, such as `~/.bashrc`, autostart entries, or cron files, potentially leading to host code execution. Furthermore, the `force fetch` fallback uses a raw `fetch()` function that bypasses the `BROWSE MCP ALLOWED ORIGINS` origin fence.